How to put python variables into an SQL statement?

Question

I'm quite a beginner to SQL so I'm probably missing something import, but I'll ask anyway:

I'm creating a login program using an SQL database in python using SQLite3. When trying to check if a security question is correct I use these lines of code:

py_Username = input()
Answer1 = input()
if Answer1 == Cursor.execute("SELECT Security_Question1 FROM UserInfo WHERE Username = " + py_Username):

When doing this I get this error and don't know why...

Traceback (most recent call last):
    if Answer1 == Cursor.execute("SELECT Security_Question1 FROM UserInfo WHERE Username = " + py_Username):
sqlite3.OperationalError: no such column: jake9

Please Help! Thanks.

Is jake9 your test input?? And in addition, the Cursor.execute() should return a list, I guess, making your check problematic. — Racooneer, Aug 08 '20 at 14:05

score 0 · Answer 1 · answered Aug 08 '20 at 14:07

You are checking the value Answer1 with the return value Cursor.execute() function which is wrong. Note that to access the tuple data you need to use Cursor.fetchall() and then iterate through it. Try experimenting with the following code and refer the documentation.

```lang-python```
 records = Cursor.execute("Statement")
 for row in records:
     print(row)

How to put python variables into an SQL statement?

1 Answers1