Remove Brackets from Python List for an SQL query [duplicate]

With SQL, you really want to avoid just inserting your value into the query. You normally leave that to the database adapter, which has specialized knowledge about how to avoid creating dangerous SQL from your values (SQL quotation escaping, a.k.a. SQL injection attacks).

Unfortunately, the pandas.io.sql module has only half-heartedly implemented parameter support.

Instead of using frame_query, just use DataFrame.from_records() directly.

First, generate the SQL query with parameters. The format of the SQL parameters differs from database adapter to database adapter, since the Python DB API standard allows for a few variants. I'll assume you are using MySQL here, which uses %s for positional parameters, echoing Python's syntax:

sql = "select * from dataBase where cus IN ({0})".format(', '.join(['%s'] * len(cus2)))

That creates enough parameters for each of the values in cus2. Then query the database:

cur = psql.execute(sql, con, params=cus2)
rows = cur.fetchall()
columns = [col_desc[0] for col_desc in cur.description]
cur.close()

result = DataFrame.from_records(rows, columns=columns, coerce_float=True)

Since you appear to be using the Sybase module module for your connection, you'll have to adjust this for the (somewhat non-standard) SQL parameter syntax that library uses. It only accepts named parameters, which use the form @name:

params = dict(('@param{0}'.format(i), v) for i, v in enumerate(cus2))
sql = "select * from dataBase where cus IN ({0})".format(
    ', '.join(sorted(params.keys())))

cur = psql.execute(sql, con, params=params)
rows = cur.fetchall()
columns = [col_desc[0] for col_desc in cur.description]
cur.close()

result = DataFrame.from_records(rows, columns=columns, coerce_float=True)