2

I am using python 2.7 to perform CRUD operations on a MS SQL 2012 DB.

I have a list of IDs called "ComputerIDs".

I want to run a query that deletes all records in the database where the ID is equal to one of the IDs in the list.

I have tried the following but it does not seem to work.

cursor.executemany("DELETE FROM Computer WHERE ID=%s", ComputerIDs)
pengz
  • 1,977
  • 3
  • 39
  • 80

2 Answers2

0
sql='DELETE FROM Computer WHERE ID  IN (%s)' 
 inlist=', '.join(map(lambda x: '%s', ComputerIDs))
sql = sql % inlist
cursor.execute(sql, ComputerIDs)
Shijo
  • 8,307
  • 2
  • 16
  • 30
  • Thanks. I would rather not use lambda if possible. Are there any other possible solutions that are parameterized properly? Thanks! – pengz Jan 12 '17 at 16:59
0

I was able to resolve the issue.

query_string = "DELETE FROM Computer WHERE ID = %s"
cursor.executemany(query_string, ComputerIDs)

Can anyone tell me if this query is parameterized properly and safe from SQL injection?

pengz
  • 1,977
  • 3
  • 39
  • 80
  • 1
    http://stackoverflow.com/a/7929438/6626530 Refer this answer to know more about sql injection – Shijo Jan 12 '17 at 18:04