I'm trying to input variables into a SQL table these variables are set above in the code. This is what's causing me the issue:
c.execute("INSERT INTO weather VALUES (temp, hum, pres)")
-
what library are you using?Nathan– Nathan2020-01-05 10:08:22 +00:00Commented Jan 5, 2020 at 10:08
-
im using sqlite3Lukas– Lukas2020-01-05 10:08:57 +00:00Commented Jan 5, 2020 at 10:08
-
Can you provide the code where you set your variables?Roberto Conte Rosito– Roberto Conte Rosito2020-01-05 10:34:24 +00:00Commented Jan 5, 2020 at 10:34
Add a comment
|
2 Answers
Taken from the documentation over at sqlite documentation
# Do this instead
t = ('RHAT',)
c.execute('SELECT * FROM stocks WHERE symbol=?', t)
print c.fetchone()
# Larger example that inserts many records at a time
purchases = [('2006-03-28', 'BUY', 'IBM', 1000, 45.00),
('2006-04-05', 'BUY', 'MSFT', 1000, 72.00),
('2006-04-06', 'SELL', 'IBM', 500, 53.00),
]
c.executemany('INSERT INTO stocks VALUES (?,?,?,?,?)', purchases)
NEVER DO THIS! IT WILL MAKE YOUR CODE VUNERABLE TO SQL INJECTION ATTACKS
symbol = 'RHAT'
c.execute("SELECT * FROM stocks WHERE symbol = '%s'" % symbol)
or
c.execute(f"SELECT * FROM stocks WHERE symbol = '{symbol}'")
NEVER DO THIS! IT WILL MAKE YOUR CODE VUNERABLE TO SQL INJECTION ATTACKS
Comments
You can use
c.execute("INSERT INTO weather VALUES (?, ?, ?)", temp, hum, pres)
