sql in python. what do with strings in sql

Question

I am calling SQL in Python and when I try to use a string in SQL it does not consider it as a string because the whole SQL statement in enclosed in "". What should I do?

This is my Python code for SQLl. I just want do_check_id to be considered as a string here.

call.sql("SELECT a.id FROM application a where ed.servicename = 'do_check_id'")

• user1907906: That's a fine string. Does it work? If not, what error do you get?
• tamasgal: Show us more code and what you expect...

Answer 1

If you want to use your do_check_id string variable inside a sql command consider using of placeholders and prepared statements:

Using psycopg2 to interact with Postgres:

cursor.execute("SELECT a.id FROM application a where ed.servicename = %s", do_check_id)

Answer 2

You may want to try with string formatting as below.

str_val = 'do_check_id'

call.sql("SELECT a.id FROM application a where ed.servicename = %s" %str_val)

• Oscar: It would be better to use the format() function: call.sql("SELECT a.id FROM application a where ed.servicename = {0}".format(str_val))
• Aaron Digulla: 1- Strings must be properly quoted in SQL. You can't simply replace them using Python's built-in % formatter or the .format() method.

Answer 3

This depends on your DB driver.

The sqlite3 driver which comes with Python uses ? for this:

t = ('RHAT',)
c.execute('SELECT * FROM stocks WHERE symbol=?', t)

Other drivers have similar features.

Don't try to build SQL yourself, there are some pitfalls that may make your code vulnerable to SQL injection.