How To pass the variable name in mysql query using python

Question

Myquery is inserted if i give the static value in fields.but throws exception if i give the variable name. My Working code

import MySQLdb
import datetime

db = MySQLdb.connect("localhost","root","pass","selvapractice" )

cursor = db.cursor()

sql = "INSERT INTO selva(name) \
       VALUES ('Selva') " 
try:
   cursor.execute(sql)
   db.commit()
except: 
   print "dffds"
   db.rollback()

db.close()

My Exception Code

import MySQLdb
import datetime

db = MySQLdb.connect("localhost","root","pass","selvapractice" )

cursor = db.cursor()
a="surya"
sql = "INSERT INTO selva(name) \
       VALUES (%s) " %(a)
try:
   cursor.execute(sql)
   db.commit()
except: 
   print "dffds"
   db.rollback()

db.close()

It prints dfffds

How to give the variable name in query?Any help will be greatly appreciated!

@Ignacio,I found out the mistake,the issus is i put (%s) instead of ('%s').now i added the single quotes in my query it works fine.Thanks for your help to identify the problem. — Selva
– Selva, Commented Sep 24, 2014 at 4:46
That's not how to fix it. That's how you create an insecure system. — Ignacio Vazquez-Abrams
– Ignacio Vazquez-Abrams, Commented Sep 24, 2014 at 4:47

Medhat Gayed · Accepted Answer · 2014-09-24 04:52:27Z

2

Try this: Note how I am passing the variable as a param to the execute function, this is better to prevent sql injection attacks.

import MySQLdb
import datetime

db = MySQLdb.connect("localhost","root","pass","selvapractice" )

cursor = db.cursor()
a="surya"
b="male"
sql = "INSERT INTO selva(name, gender) VALUES (%s, %s)"
try:
   cursor.execute(sql, [a, b])
   db.commit()
except: 
   print "dffds"
   db.rollback()

db.close()

edited Sep 24, 2014 at 4:52

answered Sep 24, 2014 at 4:45

Medhat Gayed

2,84324 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Selva Over a year ago

Thanks,It's works.can you give any example for giving one or more variables in query?

Medhat Gayed Over a year ago

Just updatd my example with two variables, does that help?

batMask · Accepted Answer · 2014-09-24 04:30:38Z

0

Try

INSERT INTO table_name (name) VALUES ('selva')

answered Sep 24, 2014 at 4:30

batMask

7343 gold badges18 silver badges35 bronze badges

2 Comments

Selva Over a year ago

you gave the static values for name.This query works for me.My question is how to give variable name instead of static value (selva)

batMask Over a year ago

INSERT INTO table_name (name) VALUES ('$name')

Collectives™ on Stack Overflow

How To pass the variable name in mysql query using python

2 Answers 2

2 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related