SQL statement fails through mysqldb.query in Python

Question

I am trying to pass a query through my script, but i get a SQL error. Running the same sql statement in Heidisql works fine.

My question is: - What am I doing wrong?

error message

_mysql.connection.query(self, query) _mysql_exceptions.ProgrammingError: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'Gabrielsen)' at line 1")

Python script where Database is the correct connection to database

F="Gunnar Gabrielsen"
Database.query('INSERT INTO documents (name) values (' + F + ');')
i=Database.query('SELECT * from documents;')
print(i)

Python version:Python 3.4

Module:Mysqldb

DB:MariaDB

Daniel Roseman · Accepted Answer · 2017-05-26 21:09:40Z

1

You haven't put quotes around your value.

But you should never do it this way anyway. Quite apart from the quoting problem, you are opening yourself to sql injection attacks.

Use a parametrised query instead:

cursor.execute('INSERT INTO documents (name) values (%s)',  (F,))

answered May 26, 2017 at 21:09

Daniel Roseman

602k68 gold badges910 silver badges923 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Trandre Over a year ago

Thank you, also for giving insight sqlinjection I saw the %s, but I never understood the application of it

Rick James · Accepted Answer · 2017-05-26 23:33:30Z

0

You have generated this:

INSERT INTO documents (name) values (Gunnar Gabrielsen);

What you need is

INSERT INTO documents (name) values ("Gunnar Gabrielsen");

But, without escaping or parameterizing, you are opening your code (and system) up to "sql injection" and other hacking.

answered May 26, 2017 at 23:33

Rick James

144k15 gold badges144 silver badges255 bronze badges

Collectives™ on Stack Overflow

SQL statement fails through mysqldb.query in Python

2 Answers 2

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related