“%s” % format vs “{0}”.format() vs “?” format

Question

In this post about SQLite, aaronasterling told me that

• cmd = \"attach \\\"%s\\\" as toMerge\" % \"b.db\" : is wrong
• cmd = \'attach

Answer 1

Because it is not being escaped. If you replaced the b.db with user input, it would leave you vulnerable to SQL injection.