parameterised postgresql select statement using python

Question

sql="select %s,tablename from pg_table_def where tablename like (%s)"

data=("schemaname","abc",)

cur.execute(sql,data)

If I pass a value as described above, then the select takes it as a string. Which is not the intention.

If I try

data=(schemaname,"abc",)

then it shows the error global name 'schemaname' is not defined.

Mureinik · Accepted Answer · 2018-09-01 08:18:36Z

2

You cannot parameterize object name (in this case, a column name) that way. You could instead resort to string manipulation:

column = "schemaname"
sql = "select {}, tablename from pg_table_def where tablename like (%s)".format(column) 
data= ("abc",)

cur.execute(sql,data)

answered Sep 1, 2018 at 8:18

Mureinik

316k54 gold badges400 silver badges405 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1