DataFrame.query() could be vulnerable to SQL injections like attacks if the user doesn't know what they are doing

Currently DataFrame.query() takes a string to query a database in a way that’s quite similar to how an SQL query reads data from a database. If a user writes code that uses pythons standard string replacement or that uses regex, the code is vunerable in a similar way to how SQL queries that are build with string replacement and regex are vulnerable.

Pythons sqlite3 writes in it’s documentation:

# Never do this -- insecure!
symbol = 'RHAT'
c.execute("SELECT * FROM stocks WHERE symbol = '%s'" % symbol)

# Do this instead
t = ('RHAT',)
c.execute('SELECT * FROM stocks WHERE symbol=?', t)

I think it would be valuable to provide a similar API for DataFrame.query(). In most cases DataFrame.query() likely will be used in scientific computing context where injection attacks aren’t a concern but sooner or later someone will write code with DataFrame.query() where injection attacks are a concern.

[alexmojaki]

If var1 is an actual string, that’s safe. If users can pass arbitrary objects with an overridden __eq__ then it might be a problem, I haven’t checked.

@ already seems like the SQL-like parameter binding you want. The problem as described originally is if you use something like %s instead which makes it easy to inject code into the string passed to query.

[do-me]

Thanks for your immediate reply!

How about the query variable substitution, e.g.

var1 = "evil string"
df.query("col1 == @var1") # engine='python')

Is there room for your former exploit or similar (also with respect to different engines)?

Maybe this might lead to a general discussion about SQL-like parameter binding. I would suggest adding some side note in the documentation about security under DataFrame.query().