1

Working on a "Password Saver" and will be using the module "cryptography" to encrypt the passwords. I need to save the key you generate from cryptography in the database as well, but I am not sure how you actually do this.

Done some google searches myself and it seems to be called a "byte string"? Not really sure what it is though.

This is what I have currently:

from cryptography.fernet import Fernet
import mysql.connector

db = mysql.connector.connect(
    host='localhost',
    user='root',
    password='',
    database='password_saver'
)

cursor = db.cursor()

key = Fernet.generate_key()

cursor.execute(f"INSERT INTO `encryption`(`encryption_key`) VALUES ({key})")

With that code I am getting this error: mysql.connector.errors.ProgrammingError: 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'b'cryptographys key is here')' at line 1

Not sure if there is a specific data type I need to use for SQL or if it is something I need to do in python?

S3DEV
  • 8,768
  • 3
  • 31
  • 42
simon sjöö
  • 365
  • 2
  • 3
  • 17

1 Answers1

3

TL;DR

Use: key = Fernet.generate_key().decode(), and change the query to a parameterised query.

There are two key elements in play here:

  • What is a byte string?
  • SQL injection

Byte String:

Given the rule that everything in a computer is a number, a 'byte string' is just that, it's a string of bytes - which is not human readable. However, the reason we can read b'my string' is because Python is doing us a favour in converting the bytes back into a readable string. But under the hood, it's just a string of bytes.

Further (interesting) reading on the subject

As for converting the byte string into a string (str), something MySQL can store in a VARCHAR field, it's as simple as:

b'my string'.decode()

So in your case, the key will be:

key = Fernet.generate_key().decode()

Another option:

Or, if you want to store the raw byte string in the database, you can convert your encryption_key column to a BLOB data type. This is a 'Binary Large OBject' field, used to store bytes. However, when it comes time to use the key value, you'll have to convert it into a string. So might as well do the conversion up front, and just store the string.

SQL Injection:

Please read up on this, I won't get into it here - but it's important.

The short story is use parameterised queries.

Change this:

cursor.execute(f"INSERT INTO `encryption` (`encryption_key`) VALUES ({key})")

To this:

cursor.execute("INSERT INTO `encryption` (`encryption_key`) VALUES (%s)", (key,))
S3DEV
  • 8,768
  • 3
  • 31
  • 42