import sqlite3 conn = sqlite3.connect('example.db') c = conn.cursor()

Usually your SQL operations will need to use values from Python variables. You shouldn’t assemble your query using Python’s string operations because doing so is insecure; it makes your program vulnerable to an SQL injection attack (see https://xkcd.com/327/ for humorous example of what can go wrong).

Instead, use the DB-API’s parameter substitution. Put ? as a placeholder wherever you want to use a value, and then provide a tuple of values as the second argument to the cursor’s execute() method. (Other database modules may use a different placeholder, such as %s or :1.) For example:

# Do this instead t = ('RHAT',) c.execute('SELECT * FROM stocks WHERE symbol=?', t) print(c.fetchone())# Larger example that inserts many records at a time purchases = [('2006-03-28', 'BUY', 'IBM', 1000, 45.00),('2006-04-05', 'BUY', 'MSFT', 1000, 72.00),('2006-04-06', 'SELL', 'IBM', 500, 53.00),] c.executemany('INSERT INTO stocks VALUES ', )

轉(zhuǎn)載于:https://www.cnblogs.com/easonbolg/articles/7875771.html

總結(jié)

以上是生活随笔為你收集整理的sqlite insert数据要用“？”代替“%s”的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。