Re: Problem with MySQL cursor

Carsten Haese wrote:

On Thu, 2007-10-11 at 15:14 +0200, Florian Lindner wrote:
Hello,
I have a function that executes a SQL statement with MySQLdb:

def executeSQL(sql, *args):
print sql % args
cursor = conn.cursor()
cursor.execute(sql, args)
cursor.close()

it's called like that:

sql = "INSERT INTO %s (%s) VALUES (%s)"
executeSQL(sql, DOMAIN_TABLE, DOMAIN_FIELD, domainname)

You can't use parameter binding to substitute table names and column
names, or any other syntax element, into a query. You can only bind
parameters in places where a literal value would be allowed (more or
less, the real rules are more complicated, but this rule of thumb gets
you close enough). You have to construct the query string like this, for
example:

sql = "INSERT INTO "+DOMAIN_TABLE+"("+DOMAIN_FIELD+") VALUES (%s)"
executeSQL(sql, domainname)

Ok, I understand it and now it works, but why is limitation? Why can't I
just the string interpolation in any playes and the cursor function escapes
any strings so that they can't do harm to my query?

Regards,

Florian
.

Relevant Pages

  • Re: reset SQL to reprocess a subfile in an inquiry program(SQLRPGLE)
    ... cursor can be associated with the statement. ... parameter marker values can be supplied with the USING option of OPEN. ... In this way a PREPARE statement is only needed when the string that ... contains the SQL statement gets changed. ...
    (comp.sys.ibm.as400.misc)
  • Re: Problem with MySQL cursor
    ... I have a function that executes a SQL statement with MySQLdb: ... cursor.execute(sql, args) ... just the string interpolation in any playes and the cursor function ...
    (comp.lang.python)
  • Re: 0x800a0cb3 when Update record
    ... so that lock type is probably not needed at all. ... UPDATE sql statement to perform this update rather than a recordset. ... I'm going to need to be able to update a record using server cursor I would ... Please correct me so I may improve my English! ...
    (microsoft.public.data.ado)
  • Re: Whats wrong?
    ... variables into the SQL statement? ... That way, as the cursor is declared only once, and even if you change the query inside the statement variable, each time you open the cursor the first query will be executed, that's not what I need. ... The USING clause should be specific for opening the cursor with a changed query each time. ...
    (comp.sys.ibm.as400.misc)
  • Re: Whats wrong?
    ... variables into the SQL statement? ... That way, as the cursor is declared only once, and even if you change the query inside the statement variable, each time you open the cursor the first query will be executed, that's not what I need. ... The USING clause should be specific for opening the cursor with a changed query each time. ...
    (comp.sys.ibm.as400.misc)