0

I've been trying for a while now and have look online and can't figure it out.

Variables are numbers and animals

sql = ("INSERT INTO favourite (number, info) VALUES (numbers, animals  )")
cursor.execute(*sql)
conn.comit()
Tom
  • 1
  • 1
  • 1
  • 2
  • Where did you look online? Did you read [official MySQL Connector documentation](https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html)? – Selcuk May 24 '16 at 05:50
  • In Python, variable names don't start with an uppercase letter. Name them `sql`, `cursor`, `conn`. –  May 24 '16 at 05:57
  • I wrote this on my phone and automatically made them upper case. – Tom May 24 '16 at 06:01
  • @Tom Please go through official documents before posting questions to Stackoverflow , otherwise you ll get block here . – ox12 May 24 '16 at 06:17
  • Possible duplicate of [How to use variables in SQL statement in Python?](https://stackoverflow.com/questions/902408/how-to-use-variables-in-sql-statement-in-python) – Ilja Everilä Jun 05 '18 at 10:43

4 Answers4

2
sql = ("INSERT INTO favourite (number, info) VALUES (%s, %s)", (numbers, animals))

for safety, always use escape, see http://dev.mysql.com/doc/refman/5.7/en/string-literals.html

Yuan Wang
  • 147
  • 4
1

Use: 

sql=("INSERT INTO favourite (number, info) VALUES ({},{})".format(numbers,animals))

Its always good to use format as per future references. Check https://docs.python.org/release/3.1.5/library/stdtypes.html#old-string-formatting-operations

Chathuranga
  • 948
  • 1
  • 12
  • 24
  • 1
    Don't insert parameters into an SQL statement manually. You need proper quoting of the values, and a chosen SQL connector library always provides this functionality. – user3159253 Apr 01 '21 at 19:31
0

I think the following should work. Let me know how it works out for you.

sql=("INSERT INTO favourite (number, info) VALUES ({},{})".format(numbers,animals))

d-coder
  • 10,756
  • 3
  • 23
  • 34
-1

Here is alternative solution which works for me

cursor = conn.cursor()
query ="INSERT INTO favourite (number, info) VALUES ('"+ variable1  +"','"+  variable2+"')"
cursor.execute(query)
conn.commit()
zengse
  • 1
  • 1
  • This is a very dangerous method, because it doesn't escape anything. Hence, if your variable includes any SQL characters, such as `;`, it will be interpreted as part of the statement. This means your code is now vulnerable to SQL injection. If your variable1 is populated with `; DROP TABLE favourite;`, it would delete the entire table and it's contents. – Tijmen Apr 01 '22 at 21:19