Question

Is it safe to use string concatenation for dynamic SQL queries in Python with psycopg2

Answer 1

Using raw string concatenation when building SQL queries in Python can expose your database to SQL injection attacks.

Consider this example:

If user_id is user-provided, an attacker could manipulate it to inject malicious SQL. 

Instead, use parameterized queries, which protect against such attacks:

Here, %s is a placeholder, and psycopg2 safely inserts the value of user_id into the query, avoiding SQL injection risks.