mysqldb query: not enough arguments for format string

Question

curs.execute ("INSERT INTO temperatur (datum, uhrzeit, ort, messwert) VALUES (CURRENT_DATE(), NOW(), %s, %s);" % ort, messwert)

drops out this->

    curs.execute ("INSERT INTO temperatur (datum, uhrzeit, ort, messwert) VALUES (CURRENT_DATE(), NOW(), %s, %s);" % ort, messwert)
TypeError: not enough arguments for format string

why is this not working?

Don't use string formatting to create SQL queries; it's an unnecessary injection risk, let the engine do it for you. In this case, the problem is simply that messwert is a second parameter to execute, not a second value to be formatted into the string. — jonrsharpe
– jonrsharpe, Commented Feb 5, 2018 at 21:00
Never perform parameter formatting in SQL yourself, it makes it very vulnerable to SQL injection. — willeM_ Van Onsem
– willeM_ Van Onsem, Commented Feb 5, 2018 at 21:01

Martijn Pieters · Accepted Answer · 2018-02-05 21:15:32Z

3

Do not use string formatting, you are exposing yourself to SQL injection.

Pass in your arguments as a sequence in the second argument:

curs.execute(
    "INSERT INTO temperatur (datum, uhrzeit, ort, messwert) "
    "VALUES (CURRENT_DATE(), NOW(), %s, %s)",
    (ort, messwert))

Here (ord, messwert) is a tuple passed in as the second argument to curs.execute(). You don't need the ; in the SQL statement.

You got the error because you only passed one value to the % string format, the expression you used is "string value" % ort, as messwert was being passed in as the second argument to curs.execute(). You'd have to use "string value" % (ord, messwert) instead. However, you should avoid using string formatting altogether however, as that leaves you vulnerable to SQL injection attacks where an attacker makes use of the lack of proper escaping applied to the values interpolated into the SQL string.

edited Feb 5, 2018 at 21:15

answered Feb 5, 2018 at 21:01

Martijn Pieters

1.1m326 gold badges4.2k silver badges3.4k bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Battery_Al · Accepted Answer · 2018-02-05 21:04:47Z

0

Everyone is right that you shouldn't use string formatting, but the quick answer for you is just that you need parentheses containing your tuple, i.e., %(ort, messwert)

answered Feb 5, 2018 at 21:04

Battery_Al

8091 gold badge7 silver badges20 bronze badges

Collectives™ on Stack Overflow

mysqldb query: not enough arguments for format string

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related