diff --git a/Doc/lib/libsqlite3.tex b/Doc/lib/libsqlite3.tex index 512ae883859..9545696da8b 100644 --- a/Doc/lib/libsqlite3.tex +++ b/Doc/lib/libsqlite3.tex @@ -47,10 +47,11 @@ variables. You shouldn't assemble your query using Python's string operations because doing so is insecure; it makes your program vulnerable to an SQL injection attack. -Instead, use SQLite's parameter substitution. Put \samp{?} as a +Instead, use the DB-API's parameter substitution. Put \samp{?} as a placeholder wherever you want to use a value, and then provide a tuple of values as the second argument to the cursor's \method{execute()} -method. For example: +method. (Other database modules may use a different placeholder, +such as \samp{\%s} or \samp{:1}.) For example: \begin{verbatim} # Never do this -- insecure!