Receiving error from sql, is it the sql command itself or something else entirely?

Question

I'm resorting to overflow as a last ditch effort. I have been facing this bug for an incredibly long time and I have had no luck. I will try anything.

My sql command is

update_query = """
UPDATE users_data
SET stocks = """+str(stock)+"""
WHERE id = """+str(userid)
cursor = connection.cursor(buffered=True)
cursor.execute(update_query)
connection.commit()

context: the variable stock is a list before I use str() on it. userid is an int before I use str() on it. the column stocks has a datatype of mediumtext the column id has a datatype of text

the error I receive is

mysql.connector.errors.ProgrammingError: 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '['gme', '1'] WHERE id = 407081272293326858' at line 2

Please help

• Ryan Deschamps: You should use a format string or another approach to your query as this approach is vulnerable to sql injections.
• Ryan Deschamps: See stackoverflow.com/a/9433548/3050664.
• Gordon Linoff: Learn to use parameters!