Python 3 sqlite parameterized SQL-query

Question

I've been trying to make a parameterized SQL-query with Python 3 and sqlite module and succeeded with just one variable. However when using two variables, I get an IndexError: tuple index out of range error. Any suggestions as to what is causing this error?

sql = ("select exists(SELECT * from USERS where PASSWORD = '{0}' AND USERNAME = '{1}')")
args = (var1,var2)
cursor = database_connection.execute((sql).format(args))

P-Gn · Accepted Answer · 2017-07-27 07:28:46Z

21

Never fill in raw entries in your sql command, this is calling for sql injection attacks.

Use the built-in fill-in function.

sql = "select exists(SELECT * from USERS where PASSWORD = ? AND USERNAME = ?)"
args = (var1,var2)
cursor = database_connection.execute(sql, args)

edited Jul 27, 2017 at 7:28

answered Jul 27, 2017 at 7:09

P-Gn

24.9k10 gold badges95 silver badges108 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Serge Ballesta Over a year ago

Nice. You fixed the error by using *args (but forgot to say it...), and insisted in correctly using parameterized queries.

B.Turris Over a year ago

Your suggestion throws a "TypeError: function takes at most 2 arguments (3 given)" error. Also one of the parenthesis is missing in the first row.

P-Gn Over a year ago

Sorry, fixed that.

Collectives™ on Stack Overflow

Python 3 sqlite parameterized SQL-query

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related