How do I issue a SQL query using pyodbc that involves python variables as the parameters?

Question

I am writing a program that searches a database and inputs the data into a excel file based on user selection from two calendars (on the GUI). I have a start and end date, I am passing those variables as parameters into a function for my SQL query.

How do I format the SQL query to select the values from the given dates?

Here is my code so far,

def load_database(startDate, endDate):
 conn = pyodbc.connect('Driver={ODBC Driver 17 for SQL Server};'
 'Server=DESKTOP-KVR7GNJ\SQLBULKROLL;' 
 'Database=db_MasterRoll;'
 'UID=sa;'
 'PWD=Z28@6420d')
 wb = Workbook()
 ws = wb.active
 ws.title = "Star Ledger"
 cursor = conn.cursor()
 cursor.execute('SELECT ID, BarCode, DateTm, EntryDoor FROM dbo.tab_Rolls WHERE (DateTm >= @startDate) AND (DateTm <= @endDate)')

a button invokes this code by running the function "call_db_code()":

def call_db_code():
 firstDate = start_dateCalendar.selection_get()
 print(firstDate)
 finalDate = end_dateCalendar.selection_get()
 print(finalDate)
 load_database(firstDate, finalDate)

Answer 1

Use ? as placeholders in the query, and provide a tuple of values to substitute for them.

cursor.execute('SELECT ID, BarCode, DateTm, EntryDoor FROM dbo.tab_Rolls WHERE (DateTm >= ?) AND (DateTm <= ?)', (startDate, endDate))

See the examples in the cursor.execute() documentation.