johnf wrote:
> Hi,
> I was recently told I was doing something wrong with my python sql statements.
> I was doing
> tempCursor.execute("Select pg_get_serial_sequence('%s','%s') as seq
> " % ('public.arcust','pkid'))
>
> and should be doing
> tempCursor.execute ( "Select pg_get_serial_sequence ( %s, %s ) as
> seq", ( 'public.arcust', 'pkid' ) )
>
> which prevented SQL injection.
Yes, good advice.
> But the above does not work when I use variables instead of strings as in
>
> tempCursor.execute ( "Select pg_get_serial_sequence ( %s, %s ) as
> seq", ( tableName, fieldName ) )
That should work, can you show us a bit more code? What is in tableName
and fieldName?
If this works:
tempCursor.execute ( "Select pg_get_serial_sequence ( %s, %s ) as
seq", ( 'public.arcust', 'pkid' ) )
Then so should this:
tableName = 'public.arcust'
fieldName = 'pkid'
tempCursor.execute ( "Select pg_get_serial_sequence ( %s, %s ) as
seq", (tableName , fieldName) )
Kent
_______________________________________________
Tutor maillist - Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor
