Can I perform SQL query in table based on user input?

Admin 1
Viewed 448

So, I am new to Stackoverflow and I hope I'm writing this question well. So I'm trying to choose a table from my database (that contains 5 tables) based on user input in python. However I'm not quite sure how to do it. Here is the code:

user_input = "table1"
db.execute("SELECT number FROM (?) WHERE person = 1;")

I'm searching for a way if it is possible. Anyway any help would be appreciated.

sqlite python
1 Answers

Well, after some verifications in order to forbid SQL injections, the easiest way is to format the query string with the user input.

db.execute ("SELECT * FROM MyTable WHERE person = {};".format(user_input))

And the content of user_input would be placed on the curly brackets.

It's not very clear on how you're getting user input, though.

user_99440750
Related