Insert a variable from a python script into MySQL [duplicate]

Question

I'm relatively new into Python and I've got a question: How can I input a variable into an SQL execution?

sql = "Insert INTO links VALUES('stackoverflow')"

Obviously, 'stackoverflow' is just a string but what do I need to change if I want to insert a variable?

Thanks for your help! Melodlebron

Gustavo Gomes · Accepted Answer · 2017-02-23 14:08:18Z

-2

what you seem to be needing is a dynamically formatted string, Python has those in the form of:

 stackoverflowString = "stackoverflow"
 sql = ("Insert INTO links VALUES('%s')" % stackoverflowString)

This will replace the string stackoverflowString inside the SQL statement.

edited Feb 23, 2017 at 14:08

answered Feb 23, 2017 at 13:59

Gustavo Gomes

3275 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Christian W. Over a year ago

What happens if stackoverflowString is 'DROP TABLE links;-- in your case? (hint: nothing good). The query needs to be properly parametrized.

Gustavo Gomes Over a year ago

Thank you I forgot to escape the string.

vaultah Over a year ago

The brackets around the query don't make it any safer.

Christian W. Over a year ago

Just leave parametrizing to the sql-connector you are using. cursor.execute(insert_statement, data) will work perfectly fine, no reason to homebrew these things.

Melodlebron Over a year ago

Thanks it worked! You're great!

|

Collectives™ on Stack Overflow

Insert a variable from a python script into MySQL [duplicate]

1 Answer 1

6 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Linked

Related