Question

Check out the following lines of Python 2.6 code I found:

key = 'hire_date' 
update_dict['key'] = update_dict[key]     #added e.g. {..., 'key': '12/31/1999'}
if key == 'hire_date':
     query_string = "UPDATE employee SET " + key + "= CAST(%(key)s AS DATE) WHERE emp_id = '" + emp.employee + "'"

I’ve tested this code, and it works. It successfully updates the employee’s hire_date field in the database to whatever date 'key'‘s value in the dictionary is.

I was in the middle of parameterizing it when I noticed the %(key)s somehow manages to get the value of the dictionary at 'key'. How does it do that? I always thought you had to add % dictionaryOrTupleOrWhatever after the string for this to work.

Answer 1

I bet you’ll find later in the code that there is a DB API execute statement that takes update_dict as a parameter. The DB API then does the substitution instead of Python string formatting and thus properly handles binding.

Have a look at this: http://furius.ca/pubcode/pub/antiorm/lib/python/dbapiext.html#escaping-in-the-dbapi-2-0