Convert python string array for SQL column names

Question

How to convert python array like columns = ['column1', 'column2', 'column3'] for forming SQL statement like

"Select column1, column2, column3 from table" ?

I can use join on array but don't know how to get rid of quotes of string.

The quotes are not part of the string. They are a display aid. — timgeb
– timgeb, Commented Dec 14, 2018 at 19:25
The quotes are not the issue. You can't parameterize column names. You'll need to format them in. If this is front-facing, you'll need to check the user input against a list of valid names to prevent SQL injection — roganjosh
– roganjosh, Commented Dec 14, 2018 at 19:27
thank you @timgeb join works just fine. did not realize they are just display aid — user1411335
– user1411335, Commented Dec 14, 2018 at 19:50

James K. Lowden · Accepted Answer · 2018-12-14 19:50:26Z

2

>>> 'select ' + ', '.join([c for c in columns]) + ' from table'
'select column1, column2, column3 from table'

Is that what you have in mind?

answered Dec 14, 2018 at 19:50

James K. Lowden

7,8551 gold badge19 silver badges32 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

user1411335 Over a year ago

Yes somehow I believed join would not be sufficient but this works

timgeb Over a year ago

@user1411335 remember that strings could contain sql injections when hacking together sql statements like this. It's better to use a robust library. You can start here.

James K. Lowden Over a year ago

@timgeb, no library will make the above secure, "robust" or no. Parameterized queries parameterize only data, not table or column names. Most SQL client libraries are similarly restricted. I suggest your caveat is misplaced because there's no data involved, no suggestion that the names come from the user, and that it's common programming practice for applications to have DBMS names hard-coded in them.

timgeb Over a year ago

@JamesK.Lowden you clearly know more about this stuff than me, so I suggest that people listen to you on this matter.

Collectives™ on Stack Overflow

Convert python string array for SQL column names

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related