From 992698534d07424fd60f123bf1c7a040d54f5471 Mon Sep 17 00:00:00 2001 From: Chad Whitacre Date: Thu, 13 Apr 2017 11:37:36 -0400 Subject: [PATCH] Fix regression in start_package_claims --- gratipay/models/participant/email.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/gratipay/models/participant/email.py b/gratipay/models/participant/email.py index 649241b1e8..fb8fafda3b 100644 --- a/gratipay/models/participant/email.py +++ b/gratipay/models/participant/email.py @@ -187,11 +187,11 @@ def start_package_claims(self, c, nonce, *packages): # do a little SQL construction. Do it in such a way that we still avoid # Python string interpolation (~= SQLi vector). - extra_sql, values = '', [] + extra_sql, values = [], [] for p in packages: - extra_sql += ' (%s, %s)' + extra_sql.append('(%s, %s)') values += [nonce, p.id] - c.run('INSERT INTO claims (nonce, package_id) VALUES' + extra_sql, values) + c.run('INSERT INTO claims (nonce, package_id) VALUES' + ', '.join(extra_sql), values) self.app.add_event( c , 'participant' , dict( id=self.id