How to escape Python boto's SelectExpression for Amazon SimpleDB

Question

Currently my code is

client = boto3.client('sdb')
query = 'SELECT * FROM `%s` WHERE "%s" = "%s"' % (domain, key, value)
response = client.select(SelectExpression = query)

The variable key and value is input by user, what are the best way to escape them in my above code?

Edit: What I concern is how to escape the fields such as we did in the past to prevent SQL injection, but now in SimpleDB

Answer 1

Subselects and destructive operations can't be performed using simpledb.

Amazon provides quoting rules: http://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/QuotingRulesSelect.html

You can apply this behavior in python using this function:

def quote(string):
    return string.replace("'", "''").replace('"', '""').replace('`', '``')

client = boto3.client('sdb')
query = 'SELECT * FROM `%s` WHERE "%s" = "%s"' % (quote(domain), quote(key), quote(value))
response = client.select(SelectExpression = query)

Answer 2

If you meant sideffect of SQL injection is deletion/destruction, SimpleDB only support querying data, if you want to protect data exposing ( that you dont want to ) check aws docs here

Note: Since the guide is good to go, i thought the link is enough