Question

I am having a field called comments.
I am effectively trying to read values from one large table into multiple tables.
Hence, my select query fetches the comment field for me.

I am constructing a Python script to do the copying from table to table.
My insert query fails when it encounters a comment field like “Sorry! we can’t process your order” because of the single quote.

I have tried using $ quotes but in vain

Here is what I am trying

#!/usr/bin/python

import psycopg2

conn = psycopg2.connect("dbname='postgres' user='postgres' host='localhost' )
mark=conn.cursor()
/* fectching the rows and doing other stuff */

addthis="insert into my_table(something) values("$$"+str(row[8])+"$$")
mark.execute(addthis)
conn.commit()

Appreciate the help!

Answer 1

1. Your insert statement should use a placeholder. In the case of psycopg2, it is %s.
2. You should pass the parameter(s) as a second argument to execute(). That way you don’t have quoting issues and you guard against SQL-injection attack.

For example:

addthis = "INSERT INTO my_table (something) VALUES (%s);"
mark.execute(addthis, ('a string you wish to insert',))