From 6663d28952491aca2c8dcf586a301fb4791b5f69 Mon Sep 17 00:00:00 2001 From: Simon Willison Date: Sun, 30 Jan 2022 07:17:20 -0800 Subject: [PATCH] SQL injection, not XSS --- docs/python-api.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/python-api.rst b/docs/python-api.rst index 6b703fe..ac835d4 100644 --- a/docs/python-api.rst +++ b/docs/python-api.rst @@ -206,7 +206,7 @@ Passing parameters Both ``db.query()`` and ``db.execute()`` accept an optional second argument for parameters to be passed to the SQL query. -This can take the form of either a tuple/list or a dictionary, depending on the type of parameters used in the query. Values passed in this way will be correctly quoted and escaped, helping avoid XSS vulnerabilities. +This can take the form of either a tuple/list or a dictionary, depending on the type of parameters used in the query. Values passed in this way will be correctly quoted and escaped, helping avoid SQL injection vulnerabilities. ``?`` parameters in the SQL query can be filled in using a list: