How can I delete a record using MySQL in Python?

Question

I have a database table called Students and I want to delete a record using SQL. Here is my code:

uid = int(input("Please enter students ID: "))
c.execute("DELETE FROM Students WHERE ID = (uid) ")

I want to input the ID variable (uid) into the c.execute

Thanks in advance.

• JustRufus: I guess you are looking for: c.execute("DELETE FROM Students WHERE ID = {} ".format(uid))
• DeepSpace: @JustRufus Keep in mind that this example is exposed to SQL injection.
• Flash Thunder: It is not, as it's int... you can't inject any code with int.

Answer 1

You must not use string interpolation as recommended in the other answer; while in this specific case it might be OK, generally it is unsafe as it opens you up to SQL injection. Instead, use the support for parameters in the execute method:

uid = int(input("Please enter students ID: "))
c.execute("DELETE FROM Students WHERE ID = %s", (uid,))

Answer 2

What Daniel Roseman said should be the correct answer.

You can insert the ID as a parameter for the .execute method. There is an answer about this here

Answer 3

Basically the syntax is:

"some string: %s, some int: %i, some double: %d" % (string_var,int_var,double_var)

so:

uid = int(input("Please enter students ID: "))
c.execute("DELETE FROM Students WHERE ID = %i" % (uid))

• DeepSpace: This code is exposed to SQL injection. OP should use a parameterized query.
• Flash Thunder: Not really... it is int... not vulnerable.
• DeepSpace: And tomorrow OP will try to use a string in the same fashion.
• Flash Thunder: Maybe, but this code is fine. Giving -1 because I don't agree with you? Oh ok.
• Daniel Roseman: What? I can't understand how you can say that. This question is entirely about how to interpolate a variable into a database call. It is unquestionably unsafe to use string formatting to do that, which is why the database API provides a safe supported way to do it.