This isn't sql, this just looks like it. Don't worry about SQL injection, it's not a concern here.
See https://bobby-tables.com/python for parametrized queries - for simply replacement use str.replace(old, new, count=1)
sql = "My VALUES are (?, ?, ?, ?)"
values = ['a', 'b', 'f', 12]
for v in values:
sql = sql.replace("?",f"'{v}'",1) # inefficient - will create intermediate strings to
# be replaced
print(sql)
Output:
My VALUES are ('a', 'b', 'f', '12')
Slightly more performant but more code as well:
sql = "My VALUES are (?, ?, ?, ?)"
values = ['a', 'b', 'f', 12]
k = iter(values)
# see list comp below for shorter approach
l = []
for c in sql:
if c != '?':
l.append(c)
else:
l.append(f"'{next(k)}'")
sql = "".join(l)
print(sql) # My VALUES are ('a', 'b', 'f', '12') as well
As list comprehension (join is faster on list then on generator comps) thx @Ev. Kuonis :
sql = "".join( [ c if c != '?' else f"'{next(k)}'" for c in sql] )