Using a variable inside the string for SQL queries using python

Question

i want to see all the data of a particular table of sql database world entered by user, The below code will give me desired output for city table, but i want table name to be entered by user and wants to make my code work for all the cases.

from sqlite3 import connect
import mysql.connector 
mydb=mysql.connector.connect(host="localhost",user="root",password="",database='world')
mycursor=mydb.cursor()
mycursor.execute("select * from city")
for i in mycursor:
    print(i)

I thought to declare city as string variable

table_name=str(input("enter table name:"))
mycursor=mydb.cursor()
mycursor.execute("select * from table_name")
for i in mycursor:
    print(i)

But i'm getting an error world.table_name doesn't exist, which i understand. is there any way to evolve at solution of my case. looking for kind help, thanks a lot.

arnaud_h · Accepted Answer · 2022-06-05 19:44:03Z

1

Use concatenation

table_name=str(input("enter table name:"))
query = "SELECT * FROM " + table_name
mycursor.execute(query)

answered Jun 5, 2022 at 19:44

arnaud_h

1215 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

rici Over a year ago

Someone had to add this.. Use prepared statements.

snakecharmerb Over a year ago

Or at least, quote the table name with backticks: q = 'select * from `%s` % table_name to reduce the risk of SQL injection (checking that the table name is an actual table would also be wise).

Collectives™ on Stack Overflow

Using a variable inside the string for SQL queries using python

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related