Question

Possible Duplicate:
Passing SQLite variables in Python

I have a function in my script that passes values to a class method, whose job it is to populate its assigned database with the variables it receives. Thing is, I’m not sure on the correct syntax since I’m not working with normal strings. Here’s the method.

def new_response(self, link_pattern, link, response, ref_id=""):
    self.db_cursor.execute('''INSERT INTO tb_memory VALUES 
    (%s, %s, %s, %s)''' % (ref_id, link_pattern, link, response))

What is the most appropriate syntactical approach?

Answer 1

Never ever use string formatting to create SQL statements! If you use string formating your program will be affected by possible SQL-injection attacks.
Use the '?' placeholder:

def new_response(self, link_pattern, link, response, ref_id=""):
    self.db_cursor.execute('''INSERT INTO tb_memory VALUES 
    (?, ?, ?, ?)''', (ref_id, link_pattern, link, response))

See the documentation for execute.