Insert Data with pymysql using inputs

Question

I'm working on a DB and I'm having trouble when using pymysql to INSERT some values

cur.execute("""INSERT INTO orders (name, size, type, is_done) VALUES (%s, %s, %s, %s)""" 
% (name, size, type, is_done))

Where name, size and type are strings and is_done is a bool

It gives me the typical error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near, so I suppose the problem is a ', but how can I solve it?

Edit

I should also add that the name value is retrieved from a MySQL DB

check which query is really executed. stackoverflow.com/questions/7071166/… I think this link can help you. — huhushow
– huhushow, Commented Jan 25, 2017 at 18:01
Thanks, but I have seen that the command really is executed, so it's a dead end... — Mikicat
– Mikicat, Commented Jan 25, 2017 at 18:07
@huhushow I have alredy found the problem, thanks for all :) — Mikicat
– Mikicat, Commented Jan 25, 2017 at 18:11

krzys_h · Accepted Answer · 2020-07-13 08:37:58Z

4

The current accepted solution has a SQL injection vulnerability. You are not supposed to format the string with the % operator - just pass the tuple of arguments as a second argument, and the library will deal with the rest.

cur.execute("INSERT INTO orders (name, size, type, is_done) VALUES (%s, %s, %s, %s)",
    (name, size, type, is_done))

Also see this answer and pymysql documentation.

answered Jul 13, 2020 at 8:37

krzys_h

15310 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

dreftymac · Accepted Answer · 2019-05-06 20:34:56Z

1

I have found the problem, which was that instead of

  cur.execute("""INSERT INTO orders (name, size, type, is_done) 
  VALUES (%s, %s, %s, %s)""" 
  % (name, size, type, is_done))

I should have done

cur.execute("""INSERT INTO orders (name, size, type, is_done) 
 VALUES ("%s", "%s", "%s", "%s")""" 
% (name, size, type, is_done))

edited May 6, 2019 at 20:34

dreftymac

32.6k27 gold badges125 silver badges191 bronze badges

answered Jan 25, 2017 at 18:09

Mikicat

732 silver badges9 bronze badges

Comments

yunusemredemirbas · Accepted Answer · 2019-12-02 11:49:01Z

0

if you don't input value for id. You have an error. Try this query.

cur.execute("insert into orders values(%s, %s, %s, %s, %s)", (None, name, size, type, is_done))

"%s" and "None" for id column. This query running my code. Note: Don't forget commit()

answered Dec 2, 2019 at 11:49

yunusemredemirbas

1521 silver badge9 bronze badges

Collectives™ on Stack Overflow

Insert Data with pymysql using inputs

3 Answers 3

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related