What is the best way to pass multiple string variables to a query string in python3

Question

I need to create a dynamic query based on two string parameters:

description = "This is the description"
comment = "This is the comment"
query = "insert into case(desc, comm) value(description, comment)"

Note: there might be single quote and double quotes in both description and comment.

How do I use formatted %s to generate the query string?

Thank you very much.

UPDATE:

Thanks to Green Cloak Guy (his/her answer has minors to be corrected), the right query is:

query = f"insert into case(description, comment) value(\'{description}\', \'{comment}\')"

Green Cloak Guy · Accepted Answer · 2020-02-21 03:59:21Z

1

Use an f-string.

query = f"insert into case({description}, {comment}) value({description}, {comment})"

Don't use any type of string formatting to do actual database queries - that leads to you having a SQL Injection problem. Use a database library instead, that properly sanitizes the data.

But if all you need to do is parse some variables into a string, this is more flexible than the % formatting that other languages tend to use (and that's technically still available in python via "some_string %s %s %s" % (str1, str2, str3)")

answered Feb 21, 2020 at 3:59

Green Cloak Guy

24.8k4 gold badges39 silver badges58 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

mdivk Over a year ago

Thank you, in the value part, both should be single quoted,

Collectives™ on Stack Overflow

What is the best way to pass multiple string variables to a query string in python3

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related