Python Dynamic Query on Strings

Question

I want to run a Dynamic query in python.

I have a combobox with 4 values (Direct, Indirect, Intermediary, Pointed). What I want to do is to write a dynamic query to interrogate my database and return the count of items. I have this code: (val is used to retrieve the value from a combobox)

c=db.cursor()
val=var.get()
query='SELECT count(*) from table where field=' + val
c.execute(query)

Now the query works if I write it like query='SELECT count(*) from table where field="Direct"' but I want it to work dynamically.

Is there any solution?

what orm are you using? you should bind parameters to your query instead of concatenating a string.. it opens you to sql injection — John Ruddell
– John Ruddell, Commented Jun 8, 2015 at 20:27

John Ruddell · Accepted Answer · 2015-06-08 20:32:46Z

1

try something like this maybe?

db.execute("SELECT count(*) from table where field = %s", [val])

this is assuming you are using pymssql which uses "%s" to bind parameters

answered Jun 8, 2015 at 20:32

John Ruddell

25.9k7 gold badges60 silver badges88 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Nick Dragosh Over a year ago

You just saved my day. Thanks a lot! Owe you one.

John Ruddell Over a year ago

@NickDragosh glad I could help! this is also a much more secure way of executing a query because if some random user hits your function they could literally destroy your database query='SELECT count(*) from table where field="' + val + '"' if they made val be val='"; DROP DATABASE;' you would be in trouble :) dont forget to mark the answer as accepted when you have a chance!

Nick Dragosh Over a year ago

Yup. Did it. Thanks for the suggestion as well. Cheers!

Collectives™ on Stack Overflow

Python Dynamic Query on Strings

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related