Question

I have this small decorator function where I am going to find an unknown number of entries in a table:

def Deco(func):
     func
     conn = sqlite3.connect('/home/User/vocab_database/vocab.db')
     with conn:
         cur = conn.cursor()
         cur.execute("SELECT name FROM sqlite_master WHERE type='table'")
         total = cur.fetchall()
         print "You have %d tables " % len(total)

       ## this line below, is where I wanted to use a formatted string ##
         cur.execute("SELECT * FROM %s") % total[0]
         entries = cur.fetchall()
         print "You have %d entries" % len(entries)

Then I get this error message:

Traceback (most recent call last):
  File "./database_trial.py", line 19, in <module>
    class Vocab:
  File "./database_trial.py", line 25, in Vocab
    @Deco        
  File "./database_trial.py", line 15, in Deco
    cur.execute("SELECT * FROM %s") % total[0]
sqlite3.OperationalError: near "%": syntax error

Does sqlite3 only accept ? operators? Or is there something I’m mucking up?

Answer 1

You’re trying to replace metadata, so unfortunately a parametrized query won’t work. You must use interpolation or the like here, but make sure that the value is sanitized; this is a possible vector for a SQL injection.

cur.execute("SELECT * FROM %s" % (total[0],))