String substitution VS proper mysql escaping

Νίκος nikos.the.gr33k at gmail.com
Thu Aug 19 02:55:38 EDT 2010


I would expect that:

"nikos" is a string, while,
("nikos") is a single element tuple.
["nikos"] is a single element list.

That way we wouldn't be needing comma seperators.
I just don't like it when "nikos" and ("nikos") is the same thing
exactly. Parentheses are to be used to define a tuple and square
brackets to define a list.

Also i want to ask whats the difference between 'nikos', "nikos" and
'''nikos''' for Python and whats the best way to use to enclose a
string.


==================================
if in my example instead of

| cursor.execute('''SELECT host, hits, date FROM visitors WHERE
| page=%s ORDER BY date DESC''',  (page,) )

i use

| cursor.execute('''SELECT host, hits, date FROM visitors WHERE
| page=%s ORDER BY date DESC''',  page)

instead which i tend to like more, would there i have a problem?

Also how how this part here page=%s doesn't need to be written as
page='%s' which is the way i used to have it written with myssql
string substitution?

==========================================

And last but not least :-) is that

http://webville.gr/index.html?page="100 ; DELETE FROM visitors;
SELECT
* FROM visitors"
===============================
don't reproduce the problem of actual deleting my data. I don't care
losing it!
I just want to see that happening with my own eyes!

but if you try it you get an error. Maybe die to whitespace in the
value of the page?
How to write that propetly?

Thank again fellows for ALL your help!



More information about the Python-list mailing list