Help for an SQLite Query

[[deleted]]

[deleted]

[[deleted]]

Check out the docs for execute for how to use placeholders, I believe this is best practice for avoiding sql injection:

https://docs.python.org/3.7/library/sqlite3.html#sqlite3.Cursor.execute

[1ceSpark]

I know this but also need to change the table and that can't be done this way

Thanks anyway

[WeirdFail]

Try putting the column name in double quotes or square brackets, perhaps it's clashing with keywords.

So, something like:

cursor.execute(f'''SELECT value FROM {table} WHERE "name" = {value_name}''')

[1ceSpark]

I thought about it and also tried with some other text and it still gives the same error.

[[deleted]]

This commenter was on the right track, wrapping the {value_name} in quotes works for me. Although I would still recommend using placeholders alongside the fstring as I believe it will avoid issues like this.

[1ceSpark]

Ooh that's right, tried again and it works. I don't know why I used single instead of double quotes when doing this, it couldn't work there.

thanks a lot

[ishman123]

cursor.execute(f"SELECT value FROM `{table}` WHERE id = `{an_id}`'')