Inserting data to mysql, avoiding sql injection using python [duplicate]

Question

where I am doing wrong? query runs successfully but no data store in database table

My block of code is

import pymysql                                                                                         
db = pymysql.connect(host='', user='', passwd='',db='')                     
cursor = db.cursor()                                                                                   
cursor.executemany("""INSERT INTO Mention ( keyword, required, optional, excluded)                     
      VALUES (%s,%s,%s,%s)""",                                                                         
     [                                                                                                 
     ("Spam","fg","gtg","uu") ,                                                                        
     ("dd","fg","gtg","uu") ,                                                                          
     ("dd","fg","gtg","uu")                                                                            
     ])                                                                                                
print(cursor.fetchmany())

did you get any error? you says "no store data" because the print not return nothing or why?. I runned your code and the data is stored, but the print not returns nothing — juanbits
– juanbits, Commented Aug 10, 2018 at 4:46
I don't think this has anything to do with SQL injection. You appear to be using the parameters properly. But you didn't commit the transaction, and pymysql does not commit implicitly. — Bill Karwin
– Bill Karwin, Commented Aug 10, 2018 at 15:35

munsifali · Accepted Answer · 2018-08-10 05:13:11Z

0

It is advised to pass the parameters into the execute function instead because they will be escaped automatically.

Try this:

insert_stmt = (
  "INSERT INTO Mention ( keyword, required, optional, excluded)                     
      VALUES (%s,%s,%s,%s)"
)
data = [                                                                                                 
     ("Spam","fg","gtg","uu") ,                                                                        
     ("dd","fg","gtg","uu") ,                                                                          
     ("dd","fg","gtg","uu")                                                                            
     ]
cursor.execute(insert_stmt, data)

answered Aug 10, 2018 at 5:13

munsifali

1,7432 gold badges24 silver badges44 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Inserting data to mysql, avoiding sql injection using python [duplicate]

1 Answer 1

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Linked

Related