Re: String substitution VS proper mysql escaping

2010-09-04 Thread Aahz
In article bc70e108-f2ca-47b5-93d4-6911dfc3b...@q22g2000yqm.googlegroups.com, =?UTF-8?B?zp3Or866zr/Pgg==?= nikos.the.gr...@gmail.com wrote: After all () used to define tuples and [] usedd to define lists. Why commas? No, () does *not* define tuples, except for the empty tuple. The comma

Re: String substitution VS proper mysql escaping

2010-08-30 Thread Gregory Ewing
Nik the Greek wrote: Yes i will i just asked to know if i were to substitute what might be the problem so to understand why i need the quoting. Because if you use % to build a query string, the result must be syntactically valid SQL. The values that you substitute into the placeholders must

Re: String substitution VS proper mysql escaping

2010-08-30 Thread Nik the Greek
On 30 Αύγ, 11:11, Gregory Ewing greg.ew...@canterbury.ac.nz wrote: Nik the Greek wrote: Yes i will i just asked to know if i were to substitute what might be the problem so to understand why i need the quoting. Because if you use % to build a query string, the result must be syntactically

Re: String substitution VS proper mysql escaping

2010-08-30 Thread Alexander Kapps
Nik the Greek wrote: cursor.execute(''' SELECT hits FROM counters WHERE page = %s and date = %s and host = %s ''' , a_tuple ) and cursor.execute(''' SELECT hits FROM counters WHERE page = %s and date = %s and host = %s ''' , (a_tuple) ) are both syntactically correct right? buw what about

Re: String substitution VS proper mysql escaping

2010-08-30 Thread MRAB
On 30/08/2010 17:09, Nik the Greek wrote: On 30 Αύγ, 11:11, Gregory Ewinggreg.ew...@canterbury.ac.nz wrote: Nik the Greek wrote: Yes i will i just asked to know if i were to substitute what might be the problem so to understand why i need the quoting. Because if you use % to build a query

Re: String substitution VS proper mysql escaping

2010-08-30 Thread MRAB
On 30/08/2010 17:34, Alexander Kapps wrote: Nik the Greek wrote: cursor.execute(''' SELECT hits FROM counters WHERE page = %s and date = %s and host = %s ''' , a_tuple ) and cursor.execute(''' SELECT hits FROM counters WHERE page = %s and date = %s and host = %s ''' , (a_tuple) ) are both

Re: String substitution VS proper mysql escaping

2010-08-30 Thread John Nagle
On 8/30/2010 1:11 AM, Gregory Ewing wrote: Nik the Greek wrote: Yes i will i just asked to know if i were to substitute what might be the problem so to understand why i need the quoting. Because if you use % to build a query string, the result must be syntactically valid SQL. The values that

Re: String substitution VS proper mysql escaping

2010-08-29 Thread MRAB
On 29/08/2010 06:13, Νίκος wrote: On 28 Αύγ, 23:12, MRABpyt...@mrabarnett.plus.com wrote: On 28/08/2010 20:51, Νίκος wrote: On 28 Αύγ, 22:35, MRABpyt...@mrabarnett.plus.comwrote: When there's more than one value you provide a tuple. It's makes sense from the point of view of

Re: String substitution VS proper mysql escaping

2010-08-29 Thread Νίκος
On 29 Αύγ, 21:34, MRAB pyt...@mrabarnett.plus.com wrote: It likes the values to be in a tuple. If there's one value, that's a 1-tuple: (page, ). I noticed that if we are dealing with just a single value 'page' will do, no need to tuple for 1-value. it handles fine as a string.

Re: String substitution VS proper mysql escaping

2010-08-29 Thread MRAB
On 30/08/2010 02:38, Νίκος wrote: On 29 Αύγ, 21:34, MRABpyt...@mrabarnett.plus.com wrote: It likes the values to be in a tuple. If there's one value, that's a 1-tuple: (page, ). I noticed that if we are dealing with just a single value 'page' will do, no need to tuple for 1-value. it

Re: String substitution VS proper mysql escaping

2010-08-29 Thread Nik the Greek
On 30 Αύγ, 05:04, MRAB pyt...@mrabarnett.plus.com wrote: when iam trying to pass a tuple to the execute methos should i pass it like this? cursor.execute(''' SELECT hits FROM counters WHERE page = %s and date = %s and host = %s ''' % (page, date, host) ) or like tuple = (page, host, date)

Re: String substitution VS proper mysql escaping

2010-08-29 Thread MRAB
On 30/08/2010 03:33, Nik the Greek wrote: On 30 Αύγ, 05:04, MRABpyt...@mrabarnett.plus.com wrote: when iam trying to pass a tuple to the execute methos should i pass it like this? cursor.execute(''' SELECT hits FROM counters WHERE page = %s and date = %s and host = %s ''' % (page, date, host)

Re: String substitution VS proper mysql escaping

2010-08-29 Thread Nik the Greek
On 30 Αύγ, 05:48, MRAB pyt...@mrabarnett.plus.com wrote: On 30/08/2010 03:33, Nik the Greek wrote: On 30 Αύγ, 05:04, MRABpyt...@mrabarnett.plus.com  wrote: when iam trying to pass a tuple to the execute methos should i pass it like this? cursor.execute(''' SELECT hits FROM

Re: String substitution VS proper mysql escaping

2010-08-28 Thread Νίκος
On 20 Αύγ, 09:04, Nik Gr nikos.the.gr...@gmail.com wrote: With regard to the % operator, it considers the string on the left to be a format string with multiple %blah things in it to replace. The thing on the right is a sequence of items to place into the format string. Can you please clarify

Re: String substitution VS proper mysql escaping

2010-08-28 Thread MRAB
On 28/08/2010 20:10, Νίκος wrote: On 20 Αύγ, 09:04, Nik Grnikos.the.gr...@gmail.com wrote: With regard to the % operator, it considers the string on the left to be a format string with multiple %blah things in it to replace. The thing on the right is a sequence of items to place into the

Re: String substitution VS proper mysql escaping

2010-08-28 Thread Νίκος
On 28 Αύγ, 22:35, MRAB pyt...@mrabarnett.plus.com wrote: On 28/08/2010 20:10, Νίκος wrote: On 20 Αύγ, 09:04, Nik Grnikos.the.gr...@gmail.com  wrote: With regard to the % operator, it considers the string on the left to be a format string with multiple %blah things in it to replace. The

Re: String substitution VS proper mysql escaping

2010-08-28 Thread Νίκος
On 28 Αύγ, 22:35, MRAB pyt...@mrabarnett.plus.com wrote: When there's more than one value you provide a tuple. It's makes sense from the point of view of consistency that you also provide a tuple when there's only one value. Can you write something that make use of more than one value?

Re: String substitution VS proper mysql escaping

2010-08-28 Thread Rami Chowdhury
2010/8/29 Νίκος nikos.the.gr...@gmail.com: On 28 Αύγ, 22:35, MRAB pyt...@mrabarnett.plus.com wrote: When there's more than one value you provide a tuple. It's makes sense from the point of view of consistency that you also provide a tuple when there's only one value. Can you write something

Re: String substitution VS proper mysql escaping

2010-08-28 Thread MRAB
On 28/08/2010 20:48, Νίκος wrote: On 28 Αύγ, 22:35, MRABpyt...@mrabarnett.plus.com wrote: On 28/08/2010 20:10, Νίκος wrote: On 20 Αύγ, 09:04, Nik Grnikos.the.gr...@gmail.comwrote: With regard to the % operator, it considers the string on the left to be a format string with multiple

Re: String substitution VS proper mysql escaping

2010-08-28 Thread MRAB
On 28/08/2010 20:51, Νίκος wrote: On 28 Αύγ, 22:35, MRABpyt...@mrabarnett.plus.com wrote: When there's more than one value you provide a tuple. It's makes sense from the point of view of consistency that you also provide a tuple when there's only one value. Can you write something that make

Re: String substitution VS proper mysql escaping

2010-08-28 Thread Νίκος
On 28 Αύγ, 23:12, MRAB pyt...@mrabarnett.plus.com wrote: On 28/08/2010 20:51, Νίκος wrote: On 28 Αύγ, 22:35, MRABpyt...@mrabarnett.plus.com  wrote: When there's more than one value you provide a tuple. It's makes sense from the point of view of consistency that you also provide a

Re: String substitution VS proper mysql escaping

2010-08-21 Thread Lawrence D'Oliveiro
In message b3d92d13-b484-4188-8665-2b5c7da15...@q22g2000yqm.googlegroups.com, Νίκος wrote: I would expect that: (nikos) is a single element tuple. Then how would you do a simple parenthesized expression? -- http://mail.python.org/mailman/listinfo/python-list

Re: String substitution VS proper mysql escaping

2010-08-20 Thread Nik Gr
Στις 20/8/2010 8:22 πμ, ο/η Cameron Simpson έγραψε: [...snip...] | Why does the page variable which is actually a string needs to be a | tuple or a list and not just as a string which is what it actually | is? With regard to the % operator, it considers the string on the left to be a format

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Νίκος
I would expect that: nikos is a string, while, (nikos) is a single element tuple. [nikos] is a single element list. That way we wouldn't be needing comma seperators. I just don't like it when nikos and (nikos) is the same thing exactly. Parentheses are to be used to define a tuple and square

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Νίκος
On 18 Αύγ, 12:50, Cameron Simpson c...@zip.com.au wrote: (nikos,) is a single element tuple. [nikos] is a single element list. [nikos,] is also a single element list, just written like the tuple. It makes more sense if i: nikos is just a string (nikos) is a single element tuple [nikos] is

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Tim Chase
On 08/19/10 02:10, Νίκος wrote: (nikos,) is a single element tuple. [nikos] is a single element list. [nikos,] is also a single element list, just written like the tuple. It makes more sense if i: nikos is just a string (nikos) is a single element tuple [nikos] is also a single element list

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Stefan Schwarzer
Hi Νίκος, On 2010-08-19 09:10, Νίκος wrote: On 18 Αύγ, 12:50, Cameron Simpson c...@zip.com.au wrote: (nikos,) is a single element tuple. [nikos] is a single element list. [nikos,] is also a single element list, just written like the tuple. It makes more sense if i: nikos is just a

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Nik Gr
Στις 19/8/2010 2:32 μμ, ο/η Tim Chase έγραψε: So Python needs a way to express that you *explicitly* mean this is one of those rare one-element tuples, not an order of operations prioritization: (1,) + (2,) to return (1,2) Yes i can see the difference now!! I just had to look at the big

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Nik Gr
Στις 19/8/2010 2:32 μμ, ο/η Tim Chase έγραψε: (1,) + (2,) to return (1,2) This is actually joining two single element tuples (1,) and (2, ) to a new bigger tuple of two elements, correct? -- http://mail.python.org/mailman/listinfo/python-list

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Tim Chase
On 08/19/10 10:42, Nik Gr wrote: You can also prefix any of them with r such as file_path = rc:\path\to\file.txt file_path = r'c:\path\to\file.txt file_path = rc:\path\to\file.txt file_path = r'''c:\path\to\file.txt''' 'r' is to avoid escaping backslashes only or other special

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Nik Gr
Στις 19/8/2010 6:58 μμ, ο/η Tim Chase έγραψε: It can be written as a non-3-quote string, you just have to escape the inner quotes (single double) and the backslash to be seen: name = 'My name is Nikos and I\'m from Thessaloniki\\Greece' name = My name is \Nikos\ and I'm from

Re: String substitution VS proper mysql escaping

2010-08-19 Thread MRAB
Nik Gr wrote: [snip] Why does the page variable which is actually a string needs to be a tuple or a list and not just as a string which is what it actually is? I have a strong desire to use it like this: cursor.execute( '''SELECT hits FROM counters WHERE page = %s''' , page ) opposed to

Re: String substitution VS proper mysql escaping

2010-08-19 Thread John Nagle
On 8/18/2010 2:50 AM, Cameron Simpson wrote: On 18Aug2010 12:07, Nik Grnikos.the.gr...@gmail.com wrote: | Στις 18/8/2010 7:31 πμ, ο/η Cameron Simpson έγραψε: |On 17Aug2010 20:15, Νίκοςnikos.the.gr...@gmail.com wrote: || === || cursor.execute( ''' SELECT host,

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Cameron Simpson
On 19Aug2010 21:50, Nik Gr nikos.the.gr...@gmail.com wrote: | Στις 19/8/2010 6:58 μμ, ο/η Tim Chase έγραψε: | It can be written as a non-3-quote string, you just have to escape | the inner quotes (single double) and the backslash to be seen: | | name = 'My name is Nikos and I\'m from

Re: String substitution VS proper mysql escaping

2010-08-18 Thread Nik Gr
Στις 18/8/2010 7:31 πμ, ο/η Cameron Simpson έγραψε: On 17Aug2010 20:15, Νίκοςnikos.the.gr...@gmail.com wrote: | === | cursor.execute( ''' SELECT host, hits, date FROM visitors WHERE page = | '%s' ORDER BY date DESC ''' % (page) ) | === |

Re: String substitution VS proper mysql escaping

2010-08-18 Thread Cameron Simpson
On 18Aug2010 12:07, Nik Gr nikos.the.gr...@gmail.com wrote: | Στις 18/8/2010 7:31 πμ, ο/η Cameron Simpson έγραψε: | On 17Aug2010 20:15, Νίκοςnikos.the.gr...@gmail.com wrote: | | === | | cursor.execute( ''' SELECT host, hits, date FROM visitors WHERE page = | | '%s'

Re: String substitution VS proper mysql escaping

2010-08-18 Thread Tim Chase
On 08/18/10 04:50, Cameron Simpson wrote: (nikos,) is a single element tuple. [nikos] is a single element list. [nikos,] is also a single element list, just written like the tuple. You don't see the [nikos,] form very often because [nikos] is not ambiguous. I most frequently see/use the

String substitution VS proper mysql escaping

2010-08-17 Thread Νίκος
=== cursor.execute( ''' SELECT host, hits, date FROM visitors WHERE page = '%s' ORDER BY date DESC ''' % (page) ) === Someone told me NOT to do string substitution (%) on SQL statements and to let MySQLdb do it for me, with proper escaping

Re: String substitution VS proper mysql escaping

2010-08-17 Thread Daniel Kluev
2010/8/18 Νίκος nikos.the.gr...@gmail.com a) I wanted to ask what is proper escaping mean and Proper escaping means that value is wrapped in quotes properly, and quotes and backslashes (or any other special to RDBMS symbol) are escaped with backslashes. why after variable page syntax has a

Re: String substitution VS proper mysql escaping

2010-08-17 Thread Cameron Simpson
On 17Aug2010 20:15, Νίκος nikos.the.gr...@gmail.com wrote: | === | cursor.execute( ''' SELECT host, hits, date FROM visitors WHERE page = | '%s' ORDER BY date DESC ''' % (page) ) | === | | Someone told me NOT to do string substitution (%) on