Home/ Questions/Q 7665261
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-31T14:31:08+00:00

I am developing python application which should work with database. I came along with

  • 0

I am developing python application which should work with database. I came along with one problem. In PHP I can make queries with variables directly just by $ sign, but in python I am writing this code:

query = "INSERT INTO shops (id, shop_id, shop_url, shop_name, shop_cat, datas)" + "VALUES("+count+", "+str(shop_id)+", "+shop_url+", "+shop_name+", "+shop_cat+", "+pdfs+datas+");"

Is there any method doing it like in PHP, I mean doing it inside one string?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You should never concatenate an SQL string like that. You are asking for an SQL injection.

    Use the built in escaping in the DB API:

    cursor.execute("INSERT INTO shops (id, shop_id, shop_url, shop_name, shop_cat, datas) VALUES (%d, %s, %s, %s, %s, %s)", (count, show_id, shop_url, shop_name, shop_cat, pdfs + datas))

    …and your query will be properly escaped.

    In general in Python, you can use “+” to concatenate strings. You can also use printf-like syntax “Hello %s!” % “World” and the newer formatting syntax “Hello {0}”.format(‘World!’)

    • 0