CODEWITHSUNDEEP
pythonweb.py
shenxugongzi
shenxugongzi

Reputation: 3

Python web.py error OperationalError: near "name": syntax error

I'm getting an error with the following code:

class SomePage:
    def GET(self,name):
        conn = sqlite3.connect('./DB/ershou.db')
        LjDB = conn.cursor()
        searcher = web.input()
        DBsearch = LjDB.execute("select * from caiji where post like '%%%s%%'"%(searcher))
        for ss in DBsearch:
            print ss[1],
            print ss[2]
        return searcher.name

This is the error I'm talking about:

OperationalError: near "name": syntax error

What is causing this error, and how do I fix it?

Upvotes: 0

Views: 109

Answers (1)

Martijn Pieters
Martijn Pieters

Reputation: 1124458

Don't use string interpolation, especially when taking input from the web! Learn the lesson Little Bobby Tables teaches and use SQL parameters:

DBsearch = LjDB.execute("select * from caiji where post like ?", 
                        ('%{}%'.format(searcher),))

This is safer, faster, and more flexible.

Upvotes: 3

Related Questions