CODEWITHSUNDEEP
pythonsqlite
Doctor code
Doctor code

Reputation: 11

Passing Safe Query Parameters with SQLite in Python

I am working on a project that uses a HTML text input to retrieve data from a SQLite database. The idea goes like this : the user types string representing a product number and I look into my database for that string.

I have tried to make my query safe for SQL injection as suggested in this tutorial because the data does not come from me.

cursor.execute("SELECT product_number FROM price_history WHERE product_number = %s';", (user_input, ))

However, when I try to execute my code, I get :

sqlite3.OperationalError: near "%": syntax error

Upvotes: 1

Views: 2166

Answers (1)

gmolnar
gmolnar

Reputation: 108

There's an extra ' after %s.

Read the first paragraphs of the python docs on sqlite3 that show the correct way to use placeholders.

cursor.execute("SELECT product_number FROM price_history WHERE product_number = (?)", (user_input, )) should work.

Upvotes: 1

Related Questions