Why is my SQL query not working?

Question

I'm posting this, and getting this error:

c.execute("""update resulttest set category=""" + key + ", value=""" + str(value))

OperationalError: (1054, "Unknown column 'composed' in 'field list'")

I am trying to update the columns category and field, composed is simply a value in category.

Why is this error coming up?

What have you tried? Have you looked at the actual query string you are composing? (Hint: it's not correct.) — jbindel
– jbindel, Commented Jul 13, 2012 at 23:19
Also, please don't do things this way. You open yourself to SQL injection problems. Use prepared statements instead. — jbindel
– jbindel, Commented Jul 13, 2012 at 23:29

Community · Accepted Answer · 2017-05-23 12:20:06Z

3

You can use interpolation and parameterized queries for easier to read syntax, no escaping quotes or anything.

c.execute("""update resulttest set category=?, value=?""", (key, value))

https://stackoverflow.com/a/775399/594589

edited May 23, 2017 at 12:20

CommunityBot

11 silver badge

answered Jul 13, 2012 at 23:19

dm03514

56.2k18 gold badges117 silver badges147 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

jbindel · Accepted Answer · 2012-07-13 23:18:22Z

2

You might see something interesting if you generate the query string and then print it out before you try to execute it. Have you tried that?

I think your quotation marks are probably not done correctly. That is, perhaps you want the query to look like this:

update resulttest set category='somekey', value='composed'

I don't think that is what you'll get for the query string you are composing.

answered Jul 13, 2012 at 23:18

jbindel

5,6652 gold badges27 silver badges38 bronze badges

Comments

GTSouza · Accepted Answer · 2012-07-13 23:32:45Z

2

// **mysql based**
string cmd = "UPDATE resulttest SET category=\"" + key + "\", value=\"" + str(value) + "\"";

// **sql based**
string cmd = "UPDATE resulttest SET category='" + key + "', value='" + str(value) + "'";

// make sure you command output a escaped format
// UPDATE resulttest SET category='test', value='test'
// UPDATE resulttest SET category="test", value="test"

c.execute(cmd);

edited Jul 13, 2012 at 23:32

answered Jul 13, 2012 at 23:15

GTSouza

3654 silver badges16 bronze badges

2 Comments

dbenham Over a year ago

I think you are barking up the wrong tree. String literals must be enclosed in single quotes within SQL.

GTSouza Over a year ago

@dbenham I have based on mysql, Why you just edit the answer to fix then?

Collectives™ on Stack Overflow

Why is my SQL query not working?

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related