CODEWITHSUNDEEP
pythonsqlpandasgoogle-bigquerysql-injection
i8oell
i8oell

Reputation: 31

How to protect against SQL Injection with pandas read_gbq

How do I use pandas_gbq.read_gbq safely to protect against SQL Injections as I cannot in the docs find a way to parametrize it

I've looked at the docs at a way to parametrize as well as googles website and other sources.

df_valid = read_gbq(QUERY_INFO.format(variable), project_id='project-1622', location='EU') Where query looks like SELECT name, date FROM table WHERE id = '{0}'

I can input p' or '1'='1 and it works

Upvotes: 2

Views: 1067

Answers (1)

Parfait
Parfait

Reputation: 107687

Per Google BigQuery docs, you have to use a specified configuration with SQL parameterized statement:

import pandas as pd

sql = "SELECT name, date FROM table WHERE id = @id"

query_config = {
    'query': {
        'parameterMode': 'NAMED',
        'queryParameters': [
            {
                'name': 'id',
                'parameterType': {'type': 'STRING'},
                'parameterValue': {'value': 1}
            }
        ]
    }
}

df = pd.read_gbq(sql, project_id='project-1622', location='EU', configuration=query_config)

Upvotes: 2

Related Questions