Question

I have created a database with MySQLdb.
In database I have a table with name student with columns:

id(is int),
id_user(is int),
f_name(is str),
l_name(is str)

I want to update a row.
My code is below:

db=mdb.connect(host="localhost", use_unicode="True", charset="utf8", 
               user="", passwd="", db="test")                          
# prepare a cursor object using cursor() method
cursor = db.cursor()

sql="""SELECT id_user FROM student"""

try:
   # Execute the SQL command
   cursor.execute(sql)
   # Commit your changes in the database
   db.commit()
except:
   # Rollback in case there is any error
   db.rollback()

rows = cursor.fetchall()

the=int(7)
se=str('ok')
for row in rows:
    r=int(row[0])
    if r==the:          
        sql2 = """UPDATE student
                SET f_name=%s
                WHERE id_user = %s"""% (se,the)

               # Execute the SQL command
        cursor.execute(sql2)
        # Commit your changes in the database
        db.commit()

        db.rollback()
# disconnect from server
db.close()

When I run it I take the error there is column with name ok why?
Can anyone help me find what I am doing wrong please?

Answer 1

You should run the query like this:

sql2 = """UPDATE student
          SET f_name = %s
          WHERE id_user = %s"""
cursor.execute(sql2, (se, the))

Don’t use string interpolation, let the database driver handle passing the parameters for you. Otherwise you have to deal with syntax errors like this, or worse, SQL injection.

More details here.