I'll admit it. I've been doing this for literally decades:
sql = 'select * from whatever where key = "%s"' % ('thing')
cursor.execute(sql)
One big reason is that
print(sql)
tells me something useful. Whereas this:
sql = 'select * from whatever where key = :key'
params = {'key': 'thing'}
cursor.execute(sql, params)
has no way to do that. Or does it? Note that this isn't as easy as doing this:
print(replace_with_dict_values(sql, params))
(replace_with_dict_values isn't real, but could easily be made.) Why not? Because in the above example, I would get this printed out:
select * from whatever where key = thing
which is missing the quoting. I want to know what the actual sql would be so I can cut and paste it into a sql editor and run the query myself while debugging. ("actual SQL" basically means "what the equivalent sql would be" and can probably be found by asking the cursor to preform the bindings and return the string. but how?)
executeexecutes what you tell it to execute. In this case, you created a query string through string formatting which exposes you to SQL injection. Use parameterized queries instead. NO amount of quoting can avoid the injection and conversion errors caused by string concatenations.mogrify.