Remove unnecessary sensationalism in docs

SQL injection and failures are bad but this seems over the top. In a
literal sense I'm struggling to imagine a scenario where bad
interpolation is worth getting shot over. And I understand this was
probably intended as hyperbole, but I don't think there's any need to
invoke the spectre of violence to make the point here.
This commit is contained in:
Andrew Lindberg 2020-10-12 09:31:21 -04:00
parent 171371da5a
commit 7440600f2e

View File

@ -211,7 +211,7 @@ reliable. We must stress this point:
Never, **never**, **NEVER** use Python string concatenation (``+``) or
string parameters interpolation (``%``) to pass variables to a SQL query
string. Not even at gunpoint.
string.
The correct way to pass variables in a SQL command is using the second
argument of the `~cursor.execute()` method::