One habit that will make you a better Python programmer from day one:
Never trust input.
It doesn't matter if the data comes from:
- a web form
- a file
- command-line arguments
- an API
- another program
- even your own database
Treat every piece of input as if it could be malformed or malicious.
For example, don't do this:
age = int(user_input)
Instead:
try:
age = int(user_input)
except ValueError:
print("Invalid number.")
When working with filenames, don't assume they're safe.
When working with SQL, always use parameterized queries instead of building SQL strings.
When running shell commands, avoid shell=True unless you absolutely need it, and never pass untrusted user input directly into a shell command.
The majority of security problems don't come from complicated code—they come from developers assuming the input is "probably fine."
Develop the habit now, and it will follow you into every project you write.
--
Darth Yoda
"Debugging the galaxy, one bite at a time."
Darth Yoda
"Debugging the galaxy, one bite at a time."