Passing SQLite variables in Python

Use parameters to .execute():

query = """
     INSERT INTO credit
         (bank, number, card, int1, value, type, int2)
     VALUES
          (?, ?, ?, ?, ?, ?, ?)
        """
data =  ['Citi', '5567', 'visa', 6000, 9.99, '23', 9000]

cursor.execute(query, data)

According to PEP249:

.execute(operation[,parameters]):

Prepare and execute a database operation (query or command). Parameters may be provided as sequence or mapping and will be bound to variables in the operation. Variables are specified in a database-specific notation (see the module’s paramstyle attribute for details)

Checking paramstyle:

>>> import sqlite3
>>> print sqlite3.paramstyle
qmark

qmark means you use ? for parameters.

Leave a Comment