CODEWITHSUNDEEP
pythonsqlsqlite
user8072518
user8072518

Reputation: 21

SQL error with sqlite in python

i have a hopefully simple Problem with an SQL-command

Code:

c.execute("SELECT MAX(pic_num) FROM Pictures WHERE id = "+str(user_id))

pic_num is a column in the database and user_id is an Integer in the database

I thought everything would be right but i get this Error:

sqlite3.OperationalError: near ")": syntax error

this Information doesn't help me at all

Upvotes: 1

Views: 271

Answers (3)

user8072518
user8072518

Reputation: 21

Thank you all for the fast answers!

c.execute("SELECT MAX(pic_num) FROM Pictures WHERE id = ?", (str(user_id), ))

this finally worked :)

I already have written some libs which should handle SQL-injection (they test the Input for quotes but you're right im very new with SQL :D)

Upvotes: 1

AnythingIsFine
AnythingIsFine

Reputation: 1807

You should python sqlite module's substitution instead like so:

c.execute("SELECT MAX(pic_num) FROM Pictures WHERE id = ?", (user_id, ))

Upvotes: 2

bruno desthuilliers
bruno desthuilliers

Reputation: 77902

The correct way to use python's db-api is to use placeholders in your SQL query and pass query values along, ie:

c.execute("SELECT MAX(pic_num) FROM Pictures WHERE id=?", [user_id,])

Note that this might not necessarily solve your problem but since you didn't post the schema nor the user_id value we can't try & reproduce the issue.

Upvotes: 2

Related Questions