Asyncpg: SQL injections

[petrucci89]

Have this library any tools for protecting sql injections?

If no, maybe somebody recommends how you solve this problem

Thx!

[elprans]

asyncpg supports native PostgreSQL syntax for parameter substitution:

v = await conn.fetchrow("SELECT * FROM table WHERE id = $1", my_id)

As long as you pass your parameters like that and never build a query string from user inputs, you should be safe from SQL injection.

[petrucci89]

Thx a lot!