not enough arguments for format string

Question

Im trying to pass a sql ( wich works perfectly if i run it on the client ) inside my python script, but i receive the error "not enough arguments for format string"

Following, the code:

sql = """
SELECT
  rr.iserver,
    foo.*, rr.queue_capacity,
    rr.queue_refill_level,
    rr.is_concurrent,
    rr.max_execution_threads,
    rr.retrieval_status,
    rr.processing_status
FROM
    (
        SELECT DISTINCT
            ip.package,
            it. TRIGGER
        FROM
            wip.info_package ip,
            wip.info_trigger it
        WHERE
            ip.service = it.service and
      ip.iserver = '%(iserver)s' and
      it.iserver = %(iserver)s'
        AND package = '%(package)s'
        UNION
            SELECT
                '%(package)s' AS package,
                TRIGGER
            FROM
                info_trigger
            WHERE
                TRIGGER LIKE '%(package)s%'
    ) AS foo,
    info_trigger rr
WHERE
    rr. TRIGGER = foo. TRIGGER
""" % {'iserver' : var_iserver,'package' : var_package}
dcon = Database_connection()
getResults = dcon.db_call(sql, dbHost, dbName, dbUser, dbPass)
# more and more code to work the result....

My main problem on this is how i can pass '%(iserver)s' , '%(package)s' correctly. Because usualy, when i select's or insert's on database, i only use two variables , but i dont know how to do it with more than two.

Thanks.

score 9 · Accepted Answer · 2012-10-17 16:29:48Z

9

Don't build SQL like this using %:

"SELECT %(foo)s FROM bar WHERE %(baz)s" %
  {"foo": "FOO", "baz": "1=1;-- DROP TABLE bar;"}

This opens the door for nasty SQL injection attacks.

Use the proper form of your Python Database API Specification v2.0 adapter. For Psychopg this form is described here.

cur.execute("SELECT %(foo)s FROM bar WHERE %(baz)s",
  {"foo": "FOO", "baz": "1=1;-- DROP TABLE bar;"})

edited Oct 17, 2012 at 16:29

answered Oct 17, 2012 at 16:24

user647772

Sign up to request clarification or add additional context in comments.

Comments

Inbar Rose · Accepted Answer · 2012-10-17 16:28:11Z

8

WHERE
                TRIGGER LIKE '%(package)s%'

you have an EXTRA '%'

if you want the actual character '%', you need to escape with a double '%'.

so it should be

WHERE
                TRIGGER LIKE '%(package)s%%'

if you want to display a '%'

and

WHERE
                TRIGGER LIKE '%(package)s'

if you dont

edited Oct 17, 2012 at 16:28

answered Oct 17, 2012 at 16:21

Inbar Rose

43.7k24 gold badges91 silver badges137 bronze badges

2 Comments

ernie Over a year ago

You may also want to switch to using str.format(), as it's preferred over % in Python 3

Inbar Rose Over a year ago

@ernie thanks +1, i did not know that. i wonder if its cosmetic, or if there are some real reasons for this.

Collectives™ on Stack Overflow

not enough arguments for format string

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related