Question

I have a large SQLite database with a mix of text and lots of other columns var1 … var 50. Most of these are numeric, though some are text based.

I am trying to extract data from the database, process it in python and write it back – I need to do this for all rows in the db.

So far, the below sort of works:

# get row using select and process
fields = (','.join(keys)) # "var1, var2, var3 ... var50"
results = ','.join([results[key] for key in keys]) # "value for var1, ... value for var50"
cur.execute('INSERT OR REPLACE INTO results (id, %s) VALUES (%s, %s);' %(fields, id, results))

This however, nulls the columns that I don’t explicitly add back. I can fix this by re-writing the code, but this feels quite messy, as I would have to surround with quotes using string concatenation and rewrite data that was there to begin with (i.e. the columns I didn’t change).

Apparently the way to run updates on rows is something like this:

update table set var1 = 4, var2 = 5, var3="some text" where id = 666;

Presumably the way for me would be to run map , and add the = signs somehow (not sure how), but how would I quote all of the results appropriately (Since I would have to quote the text fields, and they might contain quotes within them too .. )?

I’m a bit confused. Any pointers would be very helpful.

Thanks!

Answer 1

As others have stressed, use parametrized arguments. Here is an example of how you might construct the SQL statement when it has a variable number of keys:

sql=('UPDATE results SET '
     + ', '.join(key+' = ?' for key in keys)
     + 'WHERE id = ?')
args = [results[key] for key in keys] + [id]
cur.execute(sql,args)