Python MySQL connector SELECT statement issue

Question

When I'm trying to format an SQL statement this way:

cursor.execute('SELECT (%s) FROM table WHERE id = 12345', (column,))

it doesn't work properly. Instead of returning values from the specified column, it just returns the name of the column. Any way to fix that?

It only works with formatted string, but according to reviews it is not the safest approach

• Akina: Object name cannot be a parameter.
• Capitan Security: Can you add output?

Answer 1

You can't bind column names like that -you're binding a string literal with that name.

If you want to dynamically set the column names, you'll have to resort to string manipulation of some sort, e.g.:

cursor.execute(f'SELECT {column} FROM table WHERE id = 12345')

Of course if column is created by user-input, you'll have to sanitize it somehow.