How can I use a list of variables to create sql query string?

Question

I tried using the code below, but i still have the ' ' around each element in the string.

l = ['a','b','c']
query = "SELECT " + str(l).strip('[,]') + " FROM table"

returns

"SELECT 'a', 'b', 'c' FROM table"

How can I fix this?

How would you make a comma-separated string from a list of strings? (Not hammering as dupe because this is SQL and building SQL commands from variables is probably bad) — Aran-Fey
– Aran-Fey, Commented Jun 15, 2018 at 20:30
I have txt file with a list of variables. What would the preferred way to build the query? @Aran-Fey — Vince Miller
– Vince Miller, Commented Jun 15, 2018 at 20:34

jpp · Accepted Answer · 2018-06-15 20:33:44Z

2

Using str.join:

query = "SELECT " + ", ".join(l) + " FROM table"

print(query)

"SELECT a, b, c FROM table"

As pointed out, forming SQL queries from strings should be a last resort.

answered Jun 15, 2018 at 20:29

jpp

166k37 gold badges301 silver badges362 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

This is only safe if you are positive that l actually contains only valid columns names. (Also, it returns the same string the OP already has.)

@chepner, Yep. We're making several assumptions, e.g. table exists, the column list reflects valid table fields.

Azhy · Accepted Answer · 2018-06-15 20:41:14Z

0

you can use join :-

l = ['a','b','c']
query = "SELECT '" + l.join('') + "' FROM table"

print(query)

"SELECT 'abc' FROM table"

if you want them to join you can use the above code.

answered Jun 15, 2018 at 20:41

Azhy

7084 silver badges18 bronze badges