Question

when i try to use a stringvalue from a tuple as the columnname in my executemany() command, like this:

tup = ('field', 'value',)

cursor.executemany('UPDATE table SET ?=?', tup)

i get a SQlite.operationalerror:

   c.executemany('''UPDATE table SET ?=?''', tup)
sqlite3.OperationalError: near "?": syntax error

when can’t the tuple value not be inserted befor the ‘=’ and only after??

Answer 1

Because a SQL parameter indicates a literal value, one that needs quoting to protect it from being interpreted as a SQL table or column name, or a literal.

In other words, your field value will be quoted:

UPDATE table SET "field"="value"

instead of

UPDATE table SET field="value"

You’ll have to sanitize the value for field yourself to ensure that it only contains a field name and then interpolate it yourself:

'UPDATE table SET %s=?' % ('field',)

The sanitization is a hard problem; you perhaps should use a framework like SQLAlchemy to generate the SQL for you in a sane manner instead.