Parameterize the Query
150 points · 0 solved
String-building SQL is how injection happens; drivers want ? placeholders plus a separate list of values. Line 1 is a query using named placeholders :name (a : then a lowercase letter or _, then lowercase letters, digits or _). Every next line is name=value (the value may contain anything, including ', ; and =).
Print the query with every placeholder replaced by ?, then each bound value on its own line in placeholder order (a name used twice is printed twice). If a placeholder has no value, print only ERROR missing <name> for the first such placeholder.
Example 1 input
SELECT id FROM posts WHERE author = :author LIMIT :n author=alice n=10
Expected output
SELECT id FROM posts WHERE author = ? LIMIT ? alice 10
main.py
Ctrl+Enter runs · Ctrl+Shift+Enter submits