Passing Safe Query Parameters with SQLite in Python

Question

I am working on a project that uses a HTML text input to retrieve data from a SQLite database. The idea goes like this : the user types string representing a product number and I look into my database for that string.

I have tried to make my query safe for SQL injection as suggested in this tutorial because the data does not come from me.

cursor.execute("SELECT product_number FROM price_history WHERE product_number = %s';", (user_input, ))

However, when I try to execute my code, I get :

sqlite3.OperationalError: near "%": syntax error

I copy pasted the code from the tutorial and adjusted it to my database — Doctor code
– Doctor code, Commented Jul 5, 2021 at 23:33

gmolnar · Accepted Answer · 2021-07-06 00:08:46Z

1

There's an extra ' after %s.

Read the first paragraphs of the python docs on sqlite3 that show the correct way to use placeholders.

cursor.execute("SELECT product_number FROM price_history WHERE product_number = (?)", (user_input, )) should work.

answered Jul 6, 2021 at 0:08

gmolnar

1081 silver badge6 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Passing Safe Query Parameters with SQLite in Python

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related