Error : Insert Command error with Database as SQLITE

Question

I'm inserting data into SQLite using Python

database_tasks.bookId is a class variable

def insert(self, conn,dbname, name, writer='none'):
        c = conn.cursor()

        if dbname == "Book_database":            
            database_tasks.bookId += 1
            sql= "INSERT INTO Book_database VALUES(" + database_tasks.bookId + "," + name + "," + writer + ")"

        else:
            database_tasks.studentId += 1
            sql= "INSERT INTO Student VALUES("+ database_tasks.studentId + "," + name + ")"

        c.execute(sql)
        conn.commit()        
        return None

I'm getting an error with Insert command.

sql= "INSERT INTO Book_database VALUES(" + database_tasks.bookId + "," + name + "," + writer + ")"

TypeError: can only concatenate str (not "int") to str

Serge Ballesta · Accepted Answer · 2020-04-16 14:45:00Z

1

You should never build a query string including values to insert that way but used parameterized queries. It is an anti-pattern that has been used for decades to build SQL injection attacks. You should use:

    if dbname == "Book_database":            
        database_tasks.bookId += 1
        c.execute("INSERT INTO Book_database VALUES(?,?,?)",
                  (database_tasks.bookId, name, writer))

    else:
        ...

answered Apr 16, 2020 at 14:45

Serge Ballesta

150k13 gold badges137 silver badges267 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Poojan · Accepted Answer · 2020-04-16 14:33:20Z

0

it looks like your bookId is int. Cast it to str before combining.

sql= "INSERT INTO Book_database VALUES(" + str(database_tasks.bookId) + "," + name + "," + writer + ")"

answered Apr 16, 2020 at 14:33

Poojan

3,5372 gold badges20 silver badges36 bronze badges

Comments

Joseph Lane · Accepted Answer · 2020-04-16 14:35:35Z

0

The error is fairly self explanatory - you are trying to concatenate an integer to a string.

my assumption is that database_tasks.studentId is an int, so changing your query to

sql= "INSERT INTO Book_database VALUES(" + str(database_tasks.bookId) + "," + name + "," + writer + ")"

would fix this, however be aware that if this is public facing, it would be very easy to exploit this, I'd recommend fully validating input, or changing your approach to this problem.

answered Apr 16, 2020 at 14:35

Joseph Lane

2212 silver badges5 bronze badges

Collectives™ on Stack Overflow

Error : Insert Command error with Database as SQLITE

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related