W
W
Wearant2021-12-01 02:30:13
Python
Wearant, 2021-12-01 02:30:13

How to update psycorp2 data?

Please tell me what is the reason for the error?

db_connection = psycopg2.connect(DB_URI, sslmode="require")
db_object = db_connection.cursor()
db_object.execute(f"UPDATE users SET first_name = {first_name} WHERE id = {user_id}")


syntax error at or near "Paul"
LINE 1: UPDATE users SET first_name = Paul WHERE id =*****
^

Answer the question

In order to leave comments, you need to log in

1 answer(s)
A
antares4045, 2021-12-01
@Wearant

db_object.execute(f"UPDATE users SET first_name =? WHERE id =? ", [first_name, user_id] )
Or at least
db_object.execute(f"UPDATE users SET first_name = '{first_name}' WHERE id = '{ user_id}' ")
Read up on sql injections at your leisure: the anecdote about a student named DROP DATABASE will become clearer.
Upd:
Toli psycopg2, roofing felts cx_Oracle three years ago required to explicitly specify the type of injected: that is, perhaps all the question marks should be put % s

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question