Inserting data to mysql, avoiding sql injection using python

Question

where I am doing wrong? query runs successfully but no data store in database table

My block of code is

import pymysql                                                                                         
db = pymysql.connect(host='', user='', passwd='',db='')                     
cursor = db.cursor()                                                                                   
cursor.executemany("""INSERT INTO Mention ( keyword, required, optional, excluded)                     
      VALUES (%s,%s,%s,%s)""",                                                                         
     [                                                                                                 
     ("Spam","fg","gtg","uu") ,                                                                        
     ("dd","fg","gtg","uu") ,                                                                          
     ("dd","fg","gtg","uu")                                                                            
     ])                                                                                                
print(cursor.fetchmany())

did you get any error? you says "no store data" because the print not return nothing or why?. I runned your code and the data is stored, but the print not returns nothing — juanbits, Aug 10 '18 at 04:46
I don't think this has anything to do with SQL injection. You appear to be using the parameters properly. But you didn't commit the transaction, and pymysql does not commit implicitly. — Bill Karwin, Aug 10 '18 at 15:35

score 0 · Answer 1 · answered Aug 10 '18 at 05:13

It is advised to pass the parameters into the execute function instead because they will be escaped automatically.

Try this:

insert_stmt = (
  "INSERT INTO Mention ( keyword, required, optional, excluded)                     
      VALUES (%s,%s,%s,%s)"
)
data = [                                                                                                 
     ("Spam","fg","gtg","uu") ,                                                                        
     ("dd","fg","gtg","uu") ,                                                                          
     ("dd","fg","gtg","uu")                                                                            
     ]
cursor.execute(insert_stmt, data)

Inserting data to mysql, avoiding sql injection using python

1 Answers1