ansaurus

Question

Answer 1

A:

cursor.execute ("""
   UPDATE tblTableName
   SET Year=%s, Month=%s, Day=%s, Hour=%s, Minute=%s
   WHERE Server=%s
""", (Year, Month, Day, Hour, Minute, ServerID))

You can also do it with basic string manipulation,

cursor.execute ("UPDATE tblTableName SET Year=%s, Month=%s, Day=%s, Hour=%s, Minute=%s WHERE Server='%s' " % (Year, Month, Day, Hour, Minute, ServerID))

but this way is discouraged because it leaves you open for SQL Injection. As it's so easy (and similar) to do it the right way^tm, do it correctly.

The only thing you should be careful, is that some database backends don't follow the same convention for string replacement (SQLite comes to mind).

voyager 2009-08-20 16:33:46

Paolo's answer is better. http://stackoverflow.com/questions/1307378/python-mysql-update-statement/1307413#1307413

voyager 2009-08-20 16:37:37

But this one will work with every backend. This version doesn't do any validation on the input, while Paolo's way will make sure to escape the variables content.

voyager 2009-08-20 16:39:26

Do *not* do it this way. You leave yourself wide open to SQL injection attacks. Paulo has the right answer, because it ensures that the values are properly escaped before passing them to the db.

Daniel Roseman 2009-08-20 19:19:24

Ripped off Paolo's answer, as I can't delete accepted answer.

voyager 2009-08-20 23:20:22

Answer 2

+6 A:

You've got the syntax all wrong:

cursor.execute ("""
   UPDATE tblTableName
   SET Year=%s, Month=%s, Day=%s, Hour=%s, Minute=%s
   WHERE Server=%s
""", (Year, Month, Day, Hour, Minute, ServerID))

For more, read the documentation.

Paolo Bergantino 2009-08-20 16:35:46

+1 you were faster than me :)

Nadia Alramli 2009-08-20 16:38:06

ansaurus

tags:

views:

answers:

Python MYSQL update statement

related questions