Question

I have a little script that creates a certain INSERT SQL statement for me.

For postgresql I need to wrap the values to be inserted within two single quotes.

Unfortunately some of the value strings to be inserted also contain a single quote, and I need to escape them automatically.

for line in f:
    out.write('(\'' + line[:2] + '\', \'' + line[3:-1] + '\'),\n')

How can I make sure that any single quote (e.g. ‘ ) inside line[3:-1] is automatically escaped?

Thanks,

UPDATE:

e.g. the line

CI|Cote D'ivoire

fails due ‘

Update 2:

I can’t use double quotes in values, e.g.

INSERT INTO "App_country" (country_code, country_name) VALUES ("AF", "Afghanistan")

I get the error message: ERROR: column "AF" does not exist

This however works fine:

INSERT INTO "App_country" (country_code, country_name) VALUES ('AF', 'Afghanistan')

Answer 1

As described in the PEP-249, the DBPI is a generic interface to various databases. Different implementations exist for different databases. For postgres there is psycopg. from the docs:

cur.execute(
...     """INSERT INTO some_table (an_int, a_date, a_string)
...         VALUES (%s, %s, %s);""",
...     (10, datetime.date(2005, 11, 18), "O'Reilly"))

You simple pass your parameters in a tuple. The underlying library escapes it for you. This is much safer and easier than trying to roll your own.