Python Dynamic Query on Strings

Question

I want to run a Dynamic query in python.

I have a combobox with 4 values (Direct, Indirect, Intermediary, Pointed). What I want to do is to write a dynamic query to interrogate my database and return the count of items. I have this code: (val is used to retrieve the value from a combobox)

c=db.cursor()
val=var.get()
query='SELECT count(*) from table where field=' + val
c.execute(query)

Now the query works if I write it like query='SELECT count(*) from table where field="Direct"' but I want it to work dynamically.

Is there any solution?

• John Ruddell: what orm are you using? you should bind parameters to your query instead of concatenating a string.. it opens you to sql injection

Answer 1

try something like this maybe?

db.execute("SELECT count(*) from table where field = %s", [val])

this is assuming you are using pymssql which uses "%s" to bind parameters

• Nick Dragosh: You just saved my day. Thanks a lot! Owe you one.
• John Ruddell: @NickDragosh glad I could help! this is also a much more secure way of executing a query because if some random user hits your function they could literally destroy your database query='SELECT count(*) from table where field="' + val + '"' if they made val be val='"; DROP DATABASE;' you would be in trouble :) dont forget to mark the answer as accepted when you have a chance!
• Nick Dragosh: Yup. Did it. Thanks for the suggestion as well. Cheers!