Usually your SQL operations will need
to use values from Python variables.
You shouldn’t assemble your query
using Python’s string operations
because doing so is insecure; it makes
your program vulnerable to an SQL
injection attack.
Instead, use the DB-API’s parameter
substitution. Put ? as a placeholder
wherever you want to use a value, and
then provide a tuple of values as the
second argument to the cursor’s
execute() method. (Other database
modules may use a different
placeholder, such as %s or :1.) For
example:
symbol = 'IBM'
c.execute("... where symbol = '%s'" % symbol)
t = (symbol,)
c.execute('select * from stocks where symbol=?', t)
for t in [('2006-03-28', 'BUY', 'IBM', 1000, 45.00),
('2006-04-05', 'BUY', 'MSOFT', 1000, 72.00),
('2006-04-06', 'SELL', 'IBM', 500, 53.00),
]:
c.execute('insert into stocks values (?,?,?,?,?)', t)