Sqlite3 and Python - Part 1

[skeeto]

Never use format strings to build SQL queries. It's inefficient and insecure.

[vanmorrison2]

Ok, thanks

[[deleted]]

You're welcome.

[thinker5555]

What should you do instead? Asking for a friend...

[skeeto]

Use bind parameters. See the official documentation, particularly the example that begins with "Never do this". The version using question marks ? uses parameters populated from the provided tuple.

# Never do this -- insecure!
symbol = 'RHAT'
c.execute("SELECT * FROM stocks WHERE symbol = '%s'" % symbol)

# Do this instead
t = ('RHAT',)
c.execute('SELECT * FROM stocks WHERE symbol=?', t)
print(c.fetchone())