Pymysql.err.ProgrammingError: (1064, "You have an error in your SQL syntax; How to fix?

Question

Python

Hello, I have a problem:
I get an error:

Traceback (most recent call last):
File "D:\$ Programm\Bots\Bot_cat\787.py", line 114, in
bot.polling()
File "C:\Users\User\AppData\Local\Programs\Python \Python39\lib\site-packages\telebot\__init__.py", line 664, in polling
self.__threaded_polling(non_stop, interval, timeout, long_polling_timeout, allowed_updates)
File "C:\Users\User\AppData\Local\Programs\ Python\Python39\lib\site-packages\telebot\__init__.py", line 726, in __threaded_polling
raise e
File "C:\Users\User\AppData\Local\Programs\Python\Python39\lib\site-packages\telebot \__init__.py", line 686, in __threaded_polling
self.worker_pool.raise_exceptions()
File "C:\Users\User\AppData\Local\Programs\Python\Python39\lib\site-packages\telebot\util.py", line 135, in raise_exceptions
raise self.exception_info
File "C:\Users\User\ AppData\Local\Programs\Python\Python39\lib\site-packages\telebot\util.py", line 87, in run
task(*args, **kwargs)
File "D:\$ Programm\Bots\Bot_cat\787 .py", line 50, in send_rulet
coins = str(cursor.execute('SELECT coins FROM users WHERE user_id = %s' % us_id))
File "C:\Users\User\AppData\Local\Programs\Python\Python39 \lib\site-packages\pymysql\cursors.py", line 148, in execute
result = self._query(query)
File "C:\Users\User\AppData\Local\Programs\Python\Python39\lib\site- packages\pymysql\cursors.py",line 310, in_query
conn.query(q)
File "C:\Users\User\AppData\Local\Programs\Python\Python39\lib\site-packages\pymysql\connections.py", line 548, in query
self._affected_rows = self._read_query_result (unbuffered=unbuffered)
File "C:\Users\User\AppData\Local\Programs\Python\Python39\lib\site-packages\pymysql\connections.py", line 775, in _read_query_result
result.read()
File "C :\Users\User\AppData\Local\Programs\Python\Python39\lib\site-packages\pymysql\connections.py", line 1156, in read
first_packet = self.connection._read_packet()
File "C:\Users\ User\AppData\Local\Programs\Python\Python39\lib\site-packages\pymysql\connections.py", line 725, in _read_packet
packet.raise_for_error()
File "C:\Users\User\AppData\Local\Programs\Python\Python39\lib\site-packages\pymysql\protocol.py", line 221, in raise_for_error
err.raise_mysql_exception(self._data)
File "C:\ Users\User\AppData\Local\Programs\Python\Python39\lib\site-packages\pymysql\err.py", line 143, in raise_mysql_exception
raise errorclass(errno, errval)
pymysql.err.ProgrammingError: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''id': 56064826, 'is_bot': False, 'first_name': 'νσιd', 'username': 'Vindy Black' at line 1")

Here is part of the code:

@bot.message_handler(commands=['roulete'])
def send_rulet(message):
  us_id = message.from_user
  coins = str(cursor.execute('SELECT coins FROM users WHERE user_id = %s' % us_id))
  info = cursor.execute("SELECT * FROM 'users' WHERE 'user_id'='%s'" % us_id )
  if info.fetchone() is None:
    bot.send_message(message.chat.id, "Используйте /login")
  else:
                ...

Answer 1

Tell me why you put the Telegram tag at the question if there is an error in the SQL query. At the same time, without even specifying the used DBMS.
Here is the code if you are using MySql:

@bot.message_handler(commands=['roulete'])
def send_rulet(message):
  us_id = str(message.chat.id) # или integer, смотря какой тип используется в базе данных
  cursor.execute('SELECT coins FROM users WHERE user_id = “' +us_id+'“') # защита от инъекций не нужна, потому что от телеграма не может поступить инъекция
  coins = str(cursor.fetchone())
  cursor.execute("SELECT * FROM 'users' WHERE 'user_id'='" + us_id + "'")
  info = cursor.fetchone()
  if info is None:
    bot.send_message(message.chat.id, "Используйте /login")
  else:

Answer 2

Requests should still be parameterized. Parameters are not only injection protection, but also improve the performance of sql server.
Like this, in this case:
https://dev.mysql.com/doc/connector-python/en/conn...