Parameter substitution for a SQLite “IN” clause

by

You do need the right number of ?s, but that doesn’t pose a sql injection risk:

>>> result_set = c.execute('SELECT * FROM distro WHERE id IN (%s)' %
                           ','.join('?'*len(desired_ids)), desired_ids)
>>> print result_set.fetchall()
[(1, u'Ubuntu'), (2, u'Fedora'), (5, u'SuSE')]

More Related Contents:

  1. SQLite parameter substitution problem
  2. Importing a CSV file into a sqlite3 database table using Python
  3. How to retrieve inserted id after inserting row in SQLite using Python?
  4. python 3.2 UnicodeEncodeError: ‘charmap’ codec can’t encode character ‘\u2013’ in position 9629: character maps to
  5. List of tables, db schema, dump etc using the Python sqlite3 API
  6. Python insert numpy array into sqlite3 database
  7. Python CSV to SQLite
  8. Python sqlite3 and concurrency
  9. What if I don’t close the database connection in Python SQLite
  10. Passing a column name in a SELECT statement in Python
  11. HDF5 – concurrency, compression & I/O performance [closed]
  12. Parameter unsupported when inserting int
  13. Executing an SQL query over a pandas dataset
  14. “no such table” exception
  15. Is this Python code vulnerable to SQL injection? (SQLite3)
  16. SQLite Performance Benchmark — why is :memory: so slow…only 1.5X as fast as disk?
  17. pysqlite: Placeholder substitution for column or table names?
  18. SQLite not saving data between uses
  19. What is an efficient way of inserting thousands of records into an SQLite table using Django?
  20. Problem with regexp python and sqlite
  21. Python 3 sqlite parameterized SQL-query
  22. Python SQLite3 SQL Injection Vulnerable Code
  23. Why do you need to create a cursor when querying a sqlite database?
  24. How to open and convert sqlite database to pandas dataframe
  25. SQLite, python, unicode, and non-utf data
  26. Pycharm environment different than command line
  27. Can’t change system default SQLite binary
  28. Passing SQLite variables in Python
  29. Python sqlite3 parameterized drop table
  30. Python sqlite3.OperationalError: no such table:

Leave a Comment