Python web.py error OperationalError: near "name": syntax error

Question

I'm getting an error with the following code:

class SomePage:
    def GET(self,name):
        conn = sqlite3.connect('./DB/ershou.db')
        LjDB = conn.cursor()
        searcher = web.input()
        DBsearch = LjDB.execute("select * from caiji where post like '%%%s%%'"%(searcher))
        for ss in DBsearch:
            print ss[1],
            print ss[2]
        return searcher.name

This is the error I'm talking about:

OperationalError: near "name": syntax error

What is causing this error, and how do I fix it?

Martijn Pieters · Accepted Answer · 2014-07-23 21:16:28Z

3

Don't use string interpolation, especially when taking input from the web! Learn the lesson Little Bobby Tables teaches and use SQL parameters:

DBsearch = LjDB.execute("select * from caiji where post like ?", 
                        ('%{}%'.format(searcher),))

This is safer, faster, and more flexible.

answered Jul 23, 2014 at 21:16

Martijn Pieters

1.1m326 gold badges4.2k silver badges3.4k bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Python web.py error OperationalError: near "name": syntax error

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related