Insert a variable from a python script into MySQL

Question

I'm relatively new into Python and I've got a question: How can I input a variable into an SQL execution?

sql = "Insert INTO links VALUES('stackoverflow')"

Obviously, 'stackoverflow' is just a string but what do I need to change if I want to insert a variable?

Thanks for your help! Melodlebron

Gustavo Gomes · Accepted Answer · 2017-02-23T14:08:18.137

-2

what you seem to be needing is a dynamically formatted string, Python has those in the form of:

 stackoverflowString = "stackoverflow"
 sql = ("Insert INTO links VALUES('%s')" % stackoverflowString)

This will replace the string stackoverflowString inside the SQL statement.

edited Feb 23 '17 at 14:08

answered Feb 23 '17 at 13:59

Gustavo Gomes

1

What happens if `stackoverflowString` is `'DROP TABLE links;--` in your case? (hint: nothing good). The query needs to be properly parametrized. – Christian W. Feb 23 '17 at 14:03
Thank you I forgot to escape the string. – Gustavo Gomes Feb 23 '17 at 14:06
1

The brackets around the query don't make it any safer. – vaultah Feb 23 '17 at 14:10
1

Just leave parametrizing to the sql-connector you are using. `cursor.execute(insert_statement, data)` will work perfectly fine, no reason to homebrew these things. – Christian W. Feb 23 '17 at 14:13
Thanks it worked! You're great! – Melodlebron Feb 23 '17 at 14:19
But please, @Melodlebron, if you are using the cursor.execute please follow what Christian W. said because it is much safer. This also dependes if that dynamic parameter is accessible through user input or a source that you do not control. – Gustavo Gomes Feb 23 '17 at 14:23

1 Answers1