Append string in the middle of a query in python

Question

I'm trying to build a query in python, I'm looking for an elegant way to append a WHERE condition in the middle of a string:

def get_raw_queryset(frequency=None, where_condition=None):
    qs = "SELECT id, COUNT(*) AS count FROM user_transaction_log " \
         # I WANT TO APPEND A WHERE ONLY IF not None
         if where_condition:
             "WHERE .... = 1" \
         "GROUP BY type , strftime('{0}', datetime) ORDER BY id" \
         .format(frequency)
    return qs

Alex Hall · Accepted Answer · 2016-06-10 22:16:10Z

4

This will work as long as you can safely evaluate the WHERE string even if where_condition is not a string:

"SELECT ..." + bool(where_condition) * ("WHERE ...") + "GROUP ..."

I hope you're being extremely careful to avoid SQL injection.

edited Jun 10, 2016 at 22:16

answered Jun 10, 2016 at 22:12

Alex Hall

36.2k5 gold badges63 silver badges98 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Gustavo Reyes Over a year ago

I'm using django and this is a function on my backend. Should I worry?

Alex Hall Over a year ago

@GustavoReyes it depends on whether user input is used to construct that condition.

Gustavo Reyes Over a year ago

Then we're fine :)

Collectives™ on Stack Overflow

Append string in the middle of a query in python

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related