1
00:00:05,420 --> 00:00:08,360
in the previous video saw how to use the

2
00:00:08,360 --> 00:00:10,930
connection and cursor objects to execute
in the previous video saw how to use the

3
00:00:10,930 --> 00:00:14,000
sql queries against out database and
connection and cursor objects to execute

4
00:00:14,000 --> 00:00:16,010
also hopefully they've got an idea on
sql queries against out database and

5
00:00:16,010 --> 00:00:17,920
how important it is to commit your
also hopefully they've got an idea on

6
00:00:17,920 --> 00:00:19,790
changes to the database when you're
how important it is to commit your

7
00:00:19,790 --> 00:00:22,390
inserting or updating data but in this
changes to the database when you're

8
00:00:22,390 --> 00:00:23,530
video we're going to look at
inserting or updating data but in this

9
00:00:23,530 --> 00:00:26,560
placeholders and parameter substitution
video we're going to look at

10
00:00:26,560 --> 00:00:28,670
alright so what are they and what's the
placeholders and parameter substitution

11
00:00:28,670 --> 00:00:30,220
problem more importantly that they're
alright so what are they and what's the

12
00:00:30,220 --> 00:00:32,439
actually designed to solve let's
problem more importantly that they're

13
00:00:32,439 --> 00:00:33,880
actually have a look at our original
actually designed to solve let's

14
00:00:33,880 --> 00:00:37,400
update query in the contacts 2
actually have a look at our original

15
00:00:37,400 --> 00:00:39,650
. query going to change the code back
update query in the contacts 2

16
00:00:39,650 --> 00:00:41,650
to what it was before we actually have
. query going to change the code back

17
00:00:41,650 --> 00:00:44,330
changed it we had this where clause so
to what it was before we actually have

18
00:00:44,330 --> 00:00:51,080
...and if you
changed it we had this where clause so

19
00:00:51,080 --> 00:00:54,080
recall the actual update was update
...and if you

20
00:00:54,080 --> 00:00:56,350
.com but i'm actually
recall the actual update was update

21
00:00:56,350 --> 00:01:01,040
going to changes
.com but i'm actually

22
00:01:01,040 --> 00:01:02,630
and I've done that so that we can
going to changes

23
00:01:02,630 --> 00:01:03,790
actually see that things are being
and I've done that so that we can

24
00:01:03,790 --> 00:01:05,510
changed when we eventually re run this
actually see that things are being

25
00:01:05,510 --> 00:01:08,120
query now the problem with this is that
changed when we eventually re run this

26
00:01:08,120 --> 00:01:09,830
where we left it in the previous video
query now the problem with this is that

27
00:01:09,830 --> 00:01:12,760
is that we hard coded the new email
where we left it in the previous video

28
00:01:12,760 --> 00:01:15,260
address and also the condition in the
is that we hard coded the new email

29
00:01:15,260 --> 00:01:17,020
sql statement the where clause
address and also the condition in the

30
00:01:17,020 --> 00:01:19,580
normally you'd want to provide these
sql statement the where clause

31
00:01:19,580 --> 00:01:22,310
details from variables a program that
normally you'd want to provide these

32
00:01:22,310 --> 00:01:24,440
can only set the email address to another
details from variables a program that

33
00:01:24,440 --> 00:01:27,160
update update. com for rows where
can only set the email address to another

34
00:01:27,160 --> 00:01:29,800
the phone number was 1234 would be a bit
update update. com for rows where

35
00:01:29,800 --> 00:01:31,940
limited to say the least
the phone number was 1234 would be a bit

36
00:01:31,940 --> 00:01:34,610
so let's create a couple of variables to
limited to say the least

37
00:01:34,610 --> 00:01:36,920
store the new email address and the
so let's create a couple of variables to

38
00:01:36,920 --> 00:01:39,400
phone number so i'm going to add those to line 5
store the new email address and the

39
00:01:39,400 --> 00:01:42,290
we're going to start with new
phone number so i'm going to add those to line 5

40
00:01:42,290 --> 00:01:45,080
email so...
we're going to start with new

41
00:01:45,080 --> 00:01:47,570
....
email so...

42
00:01:47,570 --> 00:01:53,810
....
....

43
00:01:53,810 --> 00:01:58,640
....now we could
....

44
00:01:58,640 --> 00:02:00,590
use the string formatting that were
....now we could

45
00:02:00,590 --> 00:02:02,680
already familiar and changed
use the string formatting that were

46
00:02:02,680 --> 00:02:11,700
line 8 to something like this
already familiar and changed

47
00:02:11,700 --> 00:02:20,640
so we could do that and that would
line 8 to something like this

48
00:02:20,640 --> 00:02:22,470
actually work fine in fact lets actually
so we could do that and that would

49
00:02:22,470 --> 00:02:24,630
run that just to confirm that does work
actually work fine in fact lets actually

50
00:02:24,630 --> 00:02:30,210
and you can see that only the record
run that just to confirm that does work

51
00:02:30,210 --> 00:02:33,990
brian with the ID 1234 got his
and you can see that only the record

52
00:02:33,990 --> 00:02:34,860
email address
brian with the ID 1234 got his

53
00:02:34,860 --> 00:02:37,470
updated to another update update .com so
email address

54
00:02:37,470 --> 00:02:39,870
clearly that update actually worked and
updated to another update update .com so

55
00:02:39,870 --> 00:02:41,850
the string formatting that put in place
clearly that update actually worked and

56
00:02:41,850 --> 00:02:44,910
has actually done the job but what would
the string formatting that put in place

57
00:02:44,910 --> 00:02:47,070
happen if we allowed the phone number to
has actually done the job but what would

58
00:02:47,070 --> 00:02:48,780
be type-in by user so let's actually
happen if we allowed the phone number to

59
00:02:48,780 --> 00:02:50,730
change the program slightly to see that
be type-in by user so let's actually

60
00:02:50,730 --> 00:02:52,680
i'm going to leave the new email
change the program slightly to see that

61
00:02:52,680 --> 00:02:55,170
addresses as it was and put...
i'm going to leave the new email

62
00:02:55,170 --> 00:03:02,820
....
addresses as it was and put...

63
00:03:02,820 --> 00:03:08,820
...so I actually run that now please
....

64
00:03:08,820 --> 00:03:10,230
enter the phone number so if I actually enter the
...so I actually run that now please

65
00:03:10,230 --> 00:03:16,500
phone number 1234 you can see we've got
enter the phone number so if I actually enter the

66
00:03:16,500 --> 00:03:19,130
one row updated here so clearly the
phone number 1234 you can see we've got

67
00:03:19,130 --> 00:03:21,320
updates work we don't see any different
one row updated here so clearly the

68
00:03:21,320 --> 00:03:22,740
because the new email address is already
updates work we don't see any different

69
00:03:22,740 --> 00:03:24,350
been updated but you can see that our
because the new email address is already

70
00:03:24,350 --> 00:03:26,160
codes working now
been updated but you can see that our

71
00:03:26,160 --> 00:03:28,130
at the moment we're only executing a
codes working now

72
00:03:28,130 --> 00:03:30,380
single update query and python is
at the moment we're only executing a

73
00:03:30,380 --> 00:03:32,460
actually quite clever and won't allow
single update query and python is

74
00:03:32,460 --> 00:03:34,590
multiple statements to be used when we
actually quite clever and won't allow

75
00:03:34,590 --> 00:03:37,800
call the execute method but sometimes
multiple statements to be used when we

76
00:03:37,800 --> 00:03:38,850
you want to do that so I'm going to
call the execute method but sometimes

77
00:03:38,850 --> 00:03:42,210
actually alter line 11 here actually what I'll
you want to do that so I'm going to

78
00:03:42,210 --> 00:03:44,340
do first is after the update
actually alter line 11 here actually what I'll

79
00:03:44,340 --> 00:03:46,650
lets actually print that out....
do first is after the update

80
00:03:46,650 --> 00:03:49,230
....
lets actually print that out....

81
00:03:49,230 --> 00:03:55,260
.....here on line 11 we're actually gonna
....

82
00:03:55,260 --> 00:03:56,820
leave that line as it is but thus next line
.....here on line 11 we're actually gonna

83
00:03:56,820 --> 00:03:59,220
is where it's got update cursor .
leave that line as it is but thus next line

84
00:03:59,220 --> 00:04:02,570
execute going to change that to execute
is where it's got update cursor .

85
00:04:02,570 --> 00:04:08,130
script.....lets also change the
execute going to change that to execute

86
00:04:08,130 --> 00:04:09,750
email address so we can really confirm
script.....lets also change the

87
00:04:09,750 --> 00:04:12,240
this is working...
email address so we can really confirm

88
00:04:12,240 --> 00:04:13,590
....
this is working...

89
00:04:13,590 --> 00:04:17,399
so let's actually run that again please
....

90
00:04:17,399 --> 00:04:19,750
enter the phone number
so let's actually run that again please

91
00:04:19,750 --> 00:04:23,530
and we can see the update has
enter the phone number

92
00:04:23,530 --> 00:04:25,840
proceeded and by the way you get minus
and we can see the update has

93
00:04:25,840 --> 00:04:29,440
one rows updated here the execute
proceeded and by the way you get minus

94
00:04:29,440 --> 00:04:31,090
script method doesn't actually set the
one rows updated here the execute

95
00:04:31,090 --> 00:04:33,310
row count properly so therefore you can
script method doesn't actually set the

96
00:04:33,310 --> 00:04:35,380
ignore that particular value showing
row count properly so therefore you can

97
00:04:35,380 --> 00:04:37,090
their but overall we can see that
ignore that particular value showing

98
00:04:37,090 --> 00:04:39,220
everything is working fine in that
their but overall we can see that

99
00:04:39,220 --> 00:04:41,590
the email address was updated now why
everything is working fine in that

100
00:04:41,590 --> 00:04:43,330
do i use the execute script method for
the email address was updated now why

101
00:04:43,330 --> 00:04:45,670
well that method is designed for running
do i use the execute script method for

102
00:04:45,670 --> 00:04:47,410
more than one sql statement in a
well that method is designed for running

103
00:04:47,410 --> 00:04:49,900
single call now the individual
more than one sql statement in a

104
00:04:49,900 --> 00:04:51,340
statements must be separated by
single call now the individual

105
00:04:51,340 --> 00:04:54,160
semicolons and python will execute them
statements must be separated by

106
00:04:54,160 --> 00:04:56,380
one after the other and I know right now
semicolons and python will execute them

107
00:04:56,380 --> 00:04:58,030
we've only got a single statement here
one after the other and I know right now

108
00:04:58,030 --> 00:04:59,920
but if I'd use multiple statements it
we've only got a single statement here

109
00:04:59,920 --> 00:05:02,140
would just be confusing make it harder
but if I'd use multiple statements it

110
00:05:02,140 --> 00:05:04,090
to see what's going on in this next bit
would just be confusing make it harder

111
00:05:04,090 --> 00:05:05,680
alright so i want to show you know
to see what's going on in this next bit

112
00:05:05,680 --> 00:05:09,910
something by running it again this time
alright so i want to show you know

113
00:05:09,910 --> 00:05:11,740
we're going to type in the numbers 1 2 3
something by running it again this time

114
00:05:11,740 --> 00:05:16,930
4 semicolon drop tables or dropped table...
we're going to type in the numbers 1 2 3

115
00:05:16,930 --> 00:05:22,750
....and we
4 semicolon drop tables or dropped table...

116
00:05:22,750 --> 00:05:24,340
actually get an error at this point
....and we

117
00:05:24,340 --> 00:05:26,710
specifically the error we are looking at
actually get an error at this point

118
00:05:26,710 --> 00:05:28,090
is down here on the bottom
specifically the error we are looking at

119
00:05:28,090 --> 00:05:31,420
no such table contacts so it's obviously
is down here on the bottom

120
00:05:31,420 --> 00:05:32,830
something pretty serious has happened
no such table contacts so it's obviously

121
00:05:32,830 --> 00:05:35,890
here and you can actually print have a
something pretty serious has happened

122
00:05:35,890 --> 00:05:38,290
look at the SQL statement that we
here and you can actually print have a

123
00:05:38,290 --> 00:05:40,120
printed out the code we added to line 9
look at the SQL statement that we

124
00:05:40,120 --> 00:05:42,010
you can see what happened here
printed out the code we added to line 9

125
00:05:42,010 --> 00:05:45,700
the two sql statements here so
you can see what happened here

126
00:05:45,700 --> 00:05:47,620
you see our valid update but then
the two sql statements here so

127
00:05:47,620 --> 00:05:49,690
followed by a drop table contacts and
you see our valid update but then

128
00:05:49,690 --> 00:05:50,860
obviously we know what that does that
followed by a drop table contacts and

129
00:05:50,860 --> 00:05:52,870
actually physically drops the table from
obviously we know what that does that

130
00:05:52,870 --> 00:05:54,010
the database
actually physically drops the table from

131
00:05:54,010 --> 00:05:56,590
oops and that's an understatement i'm
the database

132
00:05:56,590 --> 00:05:58,960
going to switch back to our check DB
oops and that's an understatement i'm

133
00:05:58,960 --> 00:06:04,300
and just run that just to confirm and we
going to switch back to our check DB

134
00:06:04,300 --> 00:06:05,980
haven't got a table so the table
and just run that just to confirm and we

135
00:06:05,980 --> 00:06:07,120
has been dropped
haven't got a table so the table

136
00:06:07,120 --> 00:06:09,460
what just happened here is known as a
has been dropped

137
00:06:09,460 --> 00:06:12,310
sql injection attack this is where an
what just happened here is known as a

138
00:06:12,310 --> 00:06:15,040
attacker injects sql statements into
sql injection attack this is where an

139
00:06:15,040 --> 00:06:18,790
the sql that a program executes now a
attacker injects sql statements into

140
00:06:18,790 --> 00:06:20,530
relatively short time ago
the sql that a program executes now a

141
00:06:20,530 --> 00:06:22,180
it really was a simple as I've just
relatively short time ago

142
00:06:22,180 --> 00:06:24,520
demonstrated an attacker with a good
it really was a simple as I've just

143
00:06:24,520 --> 00:06:26,590
knowledge of sql was able to craft
demonstrated an attacker with a good

144
00:06:26,590 --> 00:06:28,720
their input so that additional
knowledge of sql was able to craft

145
00:06:28,720 --> 00:06:31,270
sql statements would be executed
their input so that additional

146
00:06:31,270 --> 00:06:32,920
you might be thinking at this point but
sql statements would be executed

147
00:06:32,920 --> 00:06:34,700
hang on to tim you have to know the name
you might be thinking at this point but

148
00:06:34,700 --> 00:06:37,420
of the table let's just see how hard it
hang on to tim you have to know the name

149
00:06:37,420 --> 00:06:39,580
is to find out as long as we know the
of the table let's just see how hard it

150
00:06:39,580 --> 00:06:42,070
type of database you're attacking and
is to find out as long as we know the

151
00:06:42,070 --> 00:06:43,450
even if the site doesn't have something
type of database you're attacking and

152
00:06:43,450 --> 00:06:45,400
like powered by Microsoft sql server
even if the site doesn't have something

153
00:06:45,400 --> 00:06:47,680
displayed at the bottom of the page a few
like powered by Microsoft sql server

154
00:06:47,680 --> 00:06:49,900
carefully crafted queries will soon
displayed at the bottom of the page a few

155
00:06:49,900 --> 00:06:52,840
determine which database is being used
carefully crafted queries will soon

156
00:06:52,840 --> 00:06:54,760
well so we'll assume at this point we've
determine which database is being used

157
00:06:54,760 --> 00:06:57,520
worked out that were attacking a sql
well so we'll assume at this point we've

158
00:06:57,520 --> 00:07:00,100
lite database going to start by running our
worked out that were attacking a sql

159
00:07:00,100 --> 00:07:02,020
original contacts .py program again
lite database going to start by running our

160
00:07:02,020 --> 00:07:03,790
because that's going to recreate the
original contacts .py program again

161
00:07:03,790 --> 00:07:04,570
table
because that's going to recreate the

162
00:07:04,570 --> 00:07:09,490
let's do that....will just go
table

163
00:07:09,490 --> 00:07:11,290
back into checked db just to confirm
let's do that....will just go

164
00:07:11,290 --> 00:07:13,930
that the tables back again you can see
back into checked db just to confirm

165
00:07:13,930 --> 00:07:16,420
and that's working and now that i've
that the tables back again you can see

166
00:07:16,420 --> 00:07:17,590
confirmed that's working lets actually
and that's working and now that i've

167
00:07:17,590 --> 00:07:19,300
make a change here instead of select
confirmed that's working lets actually

168
00:07:19,300 --> 00:07:22,420
star from contacts going to do select star
make a change here instead of select

169
00:07:22,420 --> 00:07:25,120
....you can see it's
star from contacts going to do select star

170
00:07:25,120 --> 00:07:26,740
actually come up quite helpful IntelliJ
....you can see it's

171
00:07:26,740 --> 00:07:29,110
told at the table looking to work on
actually come up quite helpful IntelliJ

172
00:07:29,110 --> 00:07:33,190
so when I actually run that we get
told at the table looking to work on

173
00:07:33,190 --> 00:07:35,710
the full details of all the tables in
so when I actually run that we get

174
00:07:35,710 --> 00:07:38,480
the database so injecting that select
the full details of all the tables in

175
00:07:38,480 --> 00:07:40,330
query when you know the results will be
the database so injecting that select

176
00:07:40,330 --> 00:07:43,210
displayed such as in a retail stock
query when you know the results will be

177
00:07:43,210 --> 00:07:45,230
search page for example can provide a
displayed such as in a retail stock

178
00:07:45,230 --> 00:07:47,420
lot of information about the database
search page for example can provide a

179
00:07:47,420 --> 00:07:50,740
structure now sql injection attacks
lot of information about the database

180
00:07:50,740 --> 00:07:52,750
were actually very common and successful
structure now sql injection attacks

181
00:07:52,750 --> 00:07:54,880
for a while they're actually still a
were actually very common and successful

182
00:07:54,880 --> 00:07:57,250
serious problem but because database
for a while they're actually still a

183
00:07:57,250 --> 00:07:59,080
administrators and programmers that's us
serious problem but because database

184
00:07:59,080 --> 00:08:01,300
by the way and now aware of them
administrators and programmers that's us

185
00:08:01,300 --> 00:08:03,100
it's much harder to attack databases
by the way and now aware of them

186
00:08:03,100 --> 00:08:05,890
that it used to be but only remain as
it's much harder to attack databases

187
00:08:05,890 --> 00:08:08,290
hard as long as we stay aware of the
that it used to be but only remain as

188
00:08:08,290 --> 00:08:10,030
problem and we write our code
hard as long as we stay aware of the

189
00:08:10,030 --> 00:08:10,900
accordingly
problem and we write our code

190
00:08:10,900 --> 00:08:12,670
now this is all being a little bit
accordingly

191
00:08:12,670 --> 00:08:14,860
contrived for one thing i had to change
now this is all being a little bit

192
00:08:14,860 --> 00:08:17,200
our code to use the execute script
contrived for one thing i had to change

193
00:08:17,200 --> 00:08:19,120
method came back to contacts 2. py
our code to use the execute script

194
00:08:19,120 --> 00:08:21,730
method code on line 12 have to
method came back to contacts 2. py

195
00:08:21,730 --> 00:08:24,280
change it to use execute script rather
method code on line 12 have to

196
00:08:24,280 --> 00:08:26,020
than execute which you wouldn't normally
change it to use execute script rather

197
00:08:26,020 --> 00:08:28,750
use when executing a query based on user
than execute which you wouldn't normally

198
00:08:28,750 --> 00:08:31,420
input but i did that to demonstrate the
use when executing a query based on user

199
00:08:31,420 --> 00:08:34,059
problem and to give a rough idea of what
input but i did that to demonstrate the

200
00:08:34,059 --> 00:08:36,490
a sql injection attack is these
problem and to give a rough idea of what

201
00:08:36,490 --> 00:08:38,559
days it's not a simple to perform an
a sql injection attack is these

202
00:08:38,559 --> 00:08:40,690
injection attack but it's still
days it's not a simple to perform an

203
00:08:40,690 --> 00:08:42,190
definitely possible
injection attack but it's still

204
00:08:42,190 --> 00:08:43,730
you just need a deeper understanding of
definitely possible

205
00:08:43,730 --> 00:08:44,780
sql
you just need a deeper understanding of

206
00:08:44,780 --> 00:08:47,030
and your target database so let's actually
sql

207
00:08:47,030 --> 00:08:49,760
see what happens if I change back
and your target database so let's actually

208
00:08:49,760 --> 00:08:52,910
the execute script back to execute again
see what happens if I change back

209
00:08:52,910 --> 00:08:58,550
here on line 12 if we run this again
the execute script back to execute again

210
00:08:58,550 --> 00:08:59,870
bearing in mind that last time with the
here on line 12 if we run this again

211
00:08:59,870 --> 00:09:02,720
execute script able to successfully
bearing in mind that last time with the

212
00:09:02,720 --> 00:09:06,050
dropped the table so enter input
execute script able to successfully

213
00:09:06,050 --> 00:09:07,280
1234
dropped the table so enter input

214
00:09:07,280 --> 00:09:12,770
...we
1234

215
00:09:12,770 --> 00:09:14,870
actually get a warning this time you can
...we

216
00:09:14,870 --> 00:09:17,480
only execute one statement at a time so
actually get a warning this time you can

217
00:09:17,480 --> 00:09:20,090
the python execute method is wise to
only execute one statement at a time so

218
00:09:20,090 --> 00:09:21,710
this trick and won't actually allow
the python execute method is wise to

219
00:09:21,710 --> 00:09:24,680
multiple statements to be executed but
this trick and won't actually allow

220
00:09:24,680 --> 00:09:26,300
with that said we have crushed the program
multiple statements to be executed but

221
00:09:26,300 --> 00:09:27,740
and that's not good
with that said we have crushed the program

222
00:09:27,740 --> 00:09:29,960
alright so this is all leading up to
and that's not good

223
00:09:29,960 --> 00:09:31,610
using placeholders and parameter
alright so this is all leading up to

224
00:09:31,610 --> 00:09:33,320
substitutions so lets actually see how
using placeholders and parameter

225
00:09:33,320 --> 00:09:35,900
both of those things can actually help
substitutions so lets actually see how

226
00:09:35,900 --> 00:09:37,430
alright so first going to
both of those things can actually help

227
00:09:37,430 --> 00:09:40,190
duplicate this line and i'm going to
alright so first going to

228
00:09:40,190 --> 00:09:43,130
comment out the one the top line and
duplicate this line and i'm going to

229
00:09:43,130 --> 00:09:45,530
going to change the line to update
comment out the one the top line and

230
00:09:45,530 --> 00:09:50,000
contacts contacts...
going to change the line to update

231
00:09:50,000 --> 00:09:52,190
...
contacts contacts...

232
00:09:52,190 --> 00:09:53,270
...
...

233
00:09:53,270 --> 00:09:54,620
...so we end up with a string
...

234
00:09:54,620 --> 00:09:56,690
like that and then we're going to come
...so we end up with a string

235
00:09:56,690 --> 00:09:58,610
down here to the update cursor .
like that and then we're going to come

236
00:09:58,610 --> 00:10:00,800
execute method instead of just having
down here to the update cursor .

237
00:10:00,800 --> 00:10:02,510
update SQL we're going to add two
execute method instead of just having

238
00:10:02,510 --> 00:10:05,780
parameter here so...
update SQL we're going to add two

239
00:10:05,780 --> 00:10:08,210
...
parameter here so...

240
00:10:08,210 --> 00:10:16,070
...
...

241
00:10:16,070 --> 00:10:19,280
let's see whether that works
...

242
00:10:19,280 --> 00:10:20,960
first you must enter some valid input
let's see whether that works

243
00:10:20,960 --> 00:10:22,970
1234 just to make sure that it does work
first you must enter some valid input

244
00:10:22,970 --> 00:10:26,300
because we've got one row updating in
1234 just to make sure that it does work

245
00:10:26,300 --> 00:10:28,010
there and i'll just put up a little bit
because we've got one row updating in

246
00:10:28,010 --> 00:10:29,210
higher so we can see that each time we
there and i'll just put up a little bit

247
00:10:29,210 --> 00:10:31,580
run and the email has clearly been
higher so we can see that each time we

248
00:10:31,580 --> 00:10:34,550
updated so that's working but let's try
run and the email has clearly been

249
00:10:34,550 --> 00:10:36,710
running again and see if we can add an
updated so that's working but let's try

250
00:10:36,710 --> 00:10:39,860
SQL injection attack again so 1234
running again and see if we can add an

251
00:10:39,860 --> 00:10:47,420
....this time
SQL injection attack again so 1234

252
00:10:47,420 --> 00:10:49,250
the program hasn't crashed we got these zeros
....this time

253
00:10:49,250 --> 00:10:51,620
updated and the Brian record hasn't
the program hasn't crashed we got these zeros

254
00:10:51,620 --> 00:10:52,880
changed at all but the point is we
updated and the Brian record hasn't

255
00:10:52,880 --> 00:10:55,310
haven't actually got an error here so
changed at all but the point is we

256
00:10:55,310 --> 00:10:58,310
it's obviously something else going on
haven't actually got an error here so

257
00:10:58,310 --> 00:11:00,080
when we use the parameter substitution
it's obviously something else going on

258
00:11:00,080 --> 00:11:02,300
rather than manipulating the updates
when we use the parameter substitution

259
00:11:02,300 --> 00:11:05,570
sql string so using placeholders which
rather than manipulating the updates

260
00:11:05,570 --> 00:11:07,610
other question marks in a string on line
sql string so using placeholders which

261
00:11:07,610 --> 00:11:11,000
9 and parameter substitution allows the
other question marks in a string on line

262
00:11:11,000 --> 00:11:12,440
python sql light library to
9 and parameter substitution allows the

263
00:11:12,440 --> 00:11:14,870
sanitize the input so that means it
python sql light library to

264
00:11:14,870 --> 00:11:16,310
will check for things like additional
sanitize the input so that means it

265
00:11:16,310 --> 00:11:18,440
sql statements that an attacker has
will check for things like additional

266
00:11:18,440 --> 00:11:21,080
tried to execute now there is a lot more
sql statements that an attacker has

267
00:11:21,080 --> 00:11:23,120
to it than that and sanitizing the
tried to execute now there is a lot more

268
00:11:23,120 --> 00:11:25,250
input is quite complex
to it than that and sanitizing the

269
00:11:25,250 --> 00:11:27,230
luckily we don't have to worry too much
input is quite complex

270
00:11:27,230 --> 00:11:29,600
about that and if you are writing a
luckily we don't have to worry too much

271
00:11:29,600 --> 00:11:31,130
database library like the sqlite
about that and if you are writing a

272
00:11:31,130 --> 00:11:33,200
three module then obviously it's
database library like the sqlite

273
00:11:33,200 --> 00:11:34,790
something you have to fully understand
three module then obviously it's

274
00:11:34,790 --> 00:11:37,130
but in our case for our purposes it's
something you have to fully understand

275
00:11:37,130 --> 00:11:38,750
enough to know that using placeholders
but in our case for our purposes it's

276
00:11:38,750 --> 00:11:40,880
rather than building up sql strings
enough to know that using placeholders

277
00:11:40,880 --> 00:11:44,270
ourselves is much safer so all the hard
rather than building up sql strings

278
00:11:44,270 --> 00:11:46,430
works been done by the programmers who
ourselves is much safer so all the hard

279
00:11:46,430 --> 00:11:48,770
created a sqlite three module and
works been done by the programmers who

280
00:11:48,770 --> 00:11:50,510
all we have to do is remember never to
created a sqlite three module and

281
00:11:50,510 --> 00:11:52,400
build up a single string using any
all we have to do is remember never to

282
00:11:52,400 --> 00:11:54,440
values that may have come from outside
build up a single string using any

283
00:11:54,440 --> 00:11:56,690
our program now it's perfectly
values that may have come from outside

284
00:11:56,690 --> 00:11:58,940
acceptable to use string formatting to
our program now it's perfectly

285
00:11:58,940 --> 00:12:00,590
provide table and column names from
acceptable to use string formatting to

286
00:12:00,590 --> 00:12:02,480
constant stored in our code for example
provide table and column names from

287
00:12:02,480 --> 00:12:05,390
but never do that if the values may have
constant stored in our code for example

288
00:12:05,390 --> 00:12:08,000
come from user input or from parameters
but never do that if the values may have

289
00:12:08,000 --> 00:12:10,490
passed to your functions from external
come from user input or from parameters

290
00:12:10,490 --> 00:12:11,930
code
passed to your functions from external

291
00:12:11,930 --> 00:12:13,010
alright I'm going to finish the video
code

292
00:12:13,010 --> 00:12:14,960
here in the next one we're going to go
alright I'm going to finish the video

293
00:12:14,960 --> 00:12:17,870
on and start looking at how we actually
here in the next one we're going to go

294
00:12:17,870 --> 00:12:19,460
use placeholders because we've talked
on and start looking at how we actually

295
00:12:19,460 --> 00:12:21,440
about the problem they are designed to solve
use placeholders because we've talked

296
00:12:21,440 --> 00:12:24,170
but let's actually move on to looking at
about the problem they are designed to solve

297
00:12:24,170 --> 00:12:25,220
them in more detail
but let's actually move on to looking at

298
00:12:25,220 --> 00:12:31,120
see you in the next video
them in more detail