Avoiding Python boto SelectExpression for Amazon SimpleDB

Question

My code is currently

client = boto3.client('sdb')
query = 'SELECT * FROM `%s` WHERE "%s" = "%s"' % (domain, key, value)
response = client.select(SelectExpression = query)

Variable keyand valueis introduced by the user, what is the best way to avoid them in my previous code?

Edit: I am worried about how to avoid fields like we did in the past to prevent SQL injection, but now in SimpleDB

Answer 1

Subsets and destructive operations cannot be performed using simpleedb.

Amazon provides citation rules: http://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/QuotingRulesSelect.html

python, :

def quote(string):
    return string.replace("'", "''").replace('"', '""').replace('`', '``')

client = boto3.client('sdb')
query = 'SELECT * FROM `%s` WHERE "%s" = "%s"' % (quote(domain), quote(key), quote(value))
response = client.select(SelectExpression = query)

Answer 2

sideffect SQL-, /, SimpleDB , ( ) aws docs

. , copy pasting ,