I keep getting the syntax error:
cur.execute('SELECT * FROM ' + table + ' WHERE Name = "%s";' %(name))
sqlite3.OperationalError: near "%": syntax error
I keep getting the syntax error:
cur.execute('SELECT * FROM ' + table + ' WHERE Name = "%s";' %(name))
sqlite3.OperationalError: near "%": syntax error
You aren't giving table
a name
Use:
table = "class%s" %(class_name)
instead of:
table = "class%s"
and don't specify result
when updating the table as that is a string, use score
instead.
I would like to reiterate what was said in one of the comments about string formatting, use the ? format instead, you are already partially doing that.
Edit concerning your comment about not knowing about string formatting.
This is string formatting:
cur.execute('UPDATE ' + table + ' WHERE Surname = "%s", WHERE Name = "%s", SET Score = "%s";'% (last_name, name, score))
and this is the preferred method, which you are already partially using:
cur.execute('INSERT INTO ' + table + ' (Surname, Name, Score) VALUES (?, ?, ?)', (last_name, name, score))
As FallenAngel has pointed out using string formatting is open to SQL injection and is therefore frowned upon, as it's a security hole. The problem in this case is that tables can't be the target of parameter substitution, so you have a dilemma. Either you write your code with hard-coded table names or if that is not an option you need to at least test for a valid table name-
There is a way with sqlite3 to test for a valid table
if you find yourself with this problem.
table = "sometable"
mycursor.execute('SELECT name FROM sqlite_master where (name = ?)', [table])
row = mycursor.fetchall()
valid_table = False
if row:
valid_table = True
if valid_table:
(perform your sql statements here.......)