CODEWITHSUNDEEP
pythonsqlpython-2.7sqlite
TDNS
TDNS

Reputation: 4365

Inserting DB name into Sqlite3 command

I'm using python 2.7.3 and Sqlite3 to save some data in a small db. I have the following sql command:

thedb = "allpeople"
cursor.execute("INSERT INTO %s VALUES (?,?,?,?,?,?,?,?,?,?,?,?)" % (thedb, data))
conn.commit()

But its throwing the following error:

TypeError: not all arguments converted during string formatting

Upvotes: 1

Views: 39

Answers (1)

Martijn Pieters
Martijn Pieters

Reputation: 1123640

You are trying to insert the table name (not the database). You appear to be mixing that up with SQL parameters; string templating and providing SQL parameters for your query are two entirely separate operations.

You'd have to use string formatting separately to build the query string:

cursor.execute("INSERT INTO %s VALUES (?,?,?,?,?,?,?,?,?,?,?,?)" % thedb, data)

or perhaps a little clearer to illustrate what is going on:

query = "INSERT INTO %s VALUES (?,?,?,?,?,?,?,?,?,?,?,?)" % thedb
cursor.execute(query, data)

Note that this opens you up to a possible SQL injection vector. Perhaps you should look into a decent SQL library instead; SQLAlchemy lets you build SQL queries from Python calls (among other tasks).

Upvotes: 1

Related Questions