Printing SQL string as argument of a cursor object

user_14903732 0
Viewed 233

Here I see the suggested way of building queries with python and sqlite3:

t = ('RHAT',)
c.execute('SELECT * FROM stocks WHERE symbol=?', t)
print(c.fetchone())

How do I print the query instead of the result? I know it's not a string, and so a "print sql" statement wouldn't work. In my case, I am running flask and I want to have this code responding to an API invocation:

...
cur = conn.cursor()
arguments = (username, password, )
query = 'SELECT * FROM logins where ((username = ?) AND (password = ?));', arguments
return(query)
...

I would expect to see this query, not to execute it. However, I receive this output:

ValueError: too many values to unpack (expected 2)

Furthermore, I didn't see any method that exports the last query issued in the SQLite.

python-3.x sqlite python
1 Answers

This might not be the answer you're looking for, but you can format the query as a string using python string format and print, before formatting again using db-api within the c.execute() statement. As long as you only format the executed query with db-api, you're not at risk from sql injection.

user_39492040
Related