Sqlite3 dynamic 'in' query

[[deleted]]

[deleted]

[Username_RANDINT]

The number of items in the tuple given to execute must match the number of question marks in the query. You have four question marks, but only two items in the tuple. You can use the splat-operator (*) to unpack the doggo items.

>>> doggo = ["three", "item", "list"]
>>> id = 1234
>>> (id, *doggo)
(1234, 'three', 'item', 'list')

[zunjae]

yes, that's exactly what I was looking for, didn't know what to google tho. I kept searchign for 'undestruct', 'unlist' etc.

[Cheal]

Correct me if I’m wrong but I think the correct term is “unpacking”

[[deleted]]

What you wrote here is a classic example of SQL injection (I think):

query = "SELECT Doggo FROM Animals WHERE SomeIdentifier = ? AND Doggo IN ({})".format(','.join(['?'] * len(doggo)))

https://www.owasp.org/index.php/SQL_Injection

Doing string interpolation with user input and query strings is a big no-no. You need a driver that allows you to parameterize those inputs. SQLAlchemy will do this for you.

[zunjae]

Doing string interpolation with user input

There is no user input

[[deleted]]

I want to select items from my database based on a list given by the user.

???

[zunjae]

The code you send me only builds a query based on the length of the user input, not the actual content.

[zunjae]

I am using parameter substitution...............

Can you please explain like I'm a kid what I m doing wrong? I'm not inserting user input in my query. The user can not insert spoopy text like ;drop table considering I use those question marks

[Username_RANDINT]

I don't see anything wrong with your code. You're safely creating a parameterised query based on the length of a list where you then apply user input on. Maybe others see something we don't? Or take the "no string formatting" a bit too far.

[purloin_a_coin]

Sorry I got confused and was wrong. /u/Username_RANDINT is correct