= ecm.db
:description: Namespace for direct SQL access to the ECM database via ado.ExecuteSQL. Supports parameterized queries with %s placeholders to prevent SQL injection.
:keywords: ecm.db, SQL, ADO, ado.ExecuteSQL, database access, SQL injection
:page-tags: api, db, overview

The `ecm.db` namespace enables direct SQL access to the ECM server's database via the `ado.ExecuteSQL` job.

NOTE: The connecting user requires appropriate database access rights on the server.
Data manipulation statements (INSERT, UPDATE, DELETE) must be explicitly enabled via a registry setting on the application server.

[cols="1,3"]
|===
|Method |Description

|xref:api/db/select.adoc[select()]
|Executes a SQL statement and returns the parsed result.
|===

== SQL injection protection

To prevent SQL injection, `select()` provides a parameter mechanism using placeholders.
Never embed user input directly into SQL via string formatting:

[source,python]
----
# Wrong — vulnerable to SQL injection
sql = f"SELECT * FROM benutzer WHERE benutzer = '{username}'"

# Correct — use placeholders
result = ecm.db.select(
    "SELECT * FROM benutzer WHERE benutzer = %s",
    username,
)
----
