sql update set ? = ? where ? = ? (python, sqlite3)

Question

Python, slite3

c.execute("UPDATE accounts SET ? = ? WHERE num=?", (db['choise'], db['data'], db['num']))

so i don't know what is wrong with it

db is shelve database

alecxe · Accepted Answer · 2016-10-11 14:08:20Z

2

The column (and table) names cannot be parameterized. Use string formatting for it and query parameterization for the rest of variables:

c.execute("UPDATE accounts SET {column} = ? WHERE num = ?".format(column=db['choise']), (db['data'], db['num']))

That said, make sure you properly validate/sanitize/escape the db['choise'] value or really trust the source of it (though don't trust anyone when it comes to database interactions).

answered Oct 11, 2016 at 14:08

alecxe

476k127 gold badges1.1k silver badges1.2k bronze badges

Sign up to request clarification or add additional context in comments.

Comments

WLatif · Accepted Answer · 2016-10-11 14:21:55Z

1

Column names cannot be given as arguments. You can try

c.execute("UPDATE accounts SET "+str(db['choise'])+" = ? WHERE num=?", (db['data'], db['num']))

answered Oct 11, 2016 at 14:21

WLatif

1,38811 silver badges19 bronze badges

Collectives™ on Stack Overflow

sql update set ? = ? where ? = ? (python, sqlite3)

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related