Fix SQL Injection (Legacy & Modern) in Tornado
Tornado's asynchronous nature doesn't protect you from the oldest trick in the book: SQL Injection. Whether you're running legacy Momoko blocks or modern SQLAlchemy-asyncio/aiopg stacks, manual string concatenation is a death sentence. To kill SQLi, you must decouple the query logic from the user-supplied data at the driver level using parameterized queries or a trusted ORM abstraction.
The Vulnerable Pattern
class VulnerableHandler(tornado.web.RequestHandler):
async def get(self):
# USER INPUT: Source of the exploit
user_id = self.get_argument('id')
# CRITICAL FAILURE: F-string or % formatting merges code and data
# Payload: ?id=1 OR 1=1 --
query = f"SELECT secret_data FROM users WHERE id = {user_id}"
# Execution of the tainted string
cursor = await self.application.db.execute(query)
result = cursor.fetchone()
self.write(str(result))</code></pre>
The Secure Implementation
The vulnerability exists because the database engine cannot distinguish between the developer's SQL commands and the user's input when they are concatenated into a single string. By using parameterized queries (also known as prepared statements), the SQL command template is sent to the database separately from the data. The database treats the user input strictly as a literal value, rendering payloads like 'OR 1=1' harmless. In modern Tornado apps, using SQLAlchemy Core or ORM is preferred as it enforces this separation by default through its expression language.
class SecureHandler(tornado.web.RequestHandler):
async def get(self):
user_id = self.get_argument('id')
# SECURE: Use placeholders (%s for psycopg2/aiopg, ? for sqlite)
# Data is passed as a separate tuple, never merged into the query string
query = "SELECT secret_data FROM users WHERE id = %s"
# The driver handles escaping and type-casting internally
cursor = await self.application.db.execute(query, (user_id,))
result = cursor.fetchone()
if result:
self.write(str(result))
else:
self.set_status(404)</code></pre>
Your Tornado API
might be exposed to SQL Injection (Legacy & Modern)
74% of Tornado apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.