Develop Reference

How to do I use %s in a mysql query without errors

I am having some trouble selecting from my database using python to execute a MySql query. I have tried two methods to achieve this, but both methods have returned the error shown below:
mysql.connector.errors.ProgrammingError: 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%s' at line 1
What Id like to do is return the row count (which is always zero or one) when a username parameter is passed. I have looked at other examples where people have had this issue but I cant find a good fix.
The first method I tried was this:
def check_data(username):
sql = """SELECT count(*) FROM tbl_user WHERE username = %s"""
mycursor.execute(sql, username)
#do something with the data
I then tried using SELECT (CASE WHEN (uname = %s) THEN TRUE ELSE FALSE END) AS IsEmtpy FROM tbl_user limit 1;
This works database side, but still throws the same error when run in the application. I tried wrapping the %s like '%s' but it didn't help.
Any suggestions?

You're missing enclosing the string between quotes (singles or doubles).
You can check the query you're executing by printing it before the mycursor.execute statement, but basically you're sending MySQL something like SELECT count(*) FROM tbl_user WHERE username = foobar.
Try fixing it with SELECT count(*) FROM tbl_user WHERE username = '%s'.
On a side note, your approach is vulnerable to SQL Injection. You should check the documentation of the tool you're using to connect to the DBMS for "prepared statements".

How to use use bind variables in mysql and python

I'm using mysql with python, I got an error when using a bind varialbe. Actually I don't know how to use a bind variable. Please help me with my problem.
Here is my code:
iouNo=textiv1.get()
cursor.execute("UPDATE iou_table SET IOU_status=4 WHERE IOU_No= :iouNo",{'iouNo':iouNo})
mydb.commit()
This is the error I got
mysql.connector.errors.ProgrammingError: 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ':'iouNo'' at line 1
I want to use the iouNo variable inside the SQL query... How can I do it?

You can read up on that iin the manual from MySQL.
%s is used as place holde.
If you only have one parameter or variable you still have tpo use a 2 dimensional tuple,
iouNo=textiv1.get()
cursor.execute("UPDATE iou_table SET IOU_status=4 WHERE IOU_No= %s;",(iouNo,))
mydb.commit()

Not able to insert INT data in Python using MySQL connector

I'm using MySQL connector in Python and trying to insert an integer data, but I keep getting this error:
mysql.connector.errors.ProgrammingError: 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%s)' at line 1
My code looks like this:
medDosage = int(''.join(filter(str.isdigit, '42mg')))
myCursor.execute("INSERT INTO dosage (dosageDesc) VALUES (%s)", medDosage)
db.commit()
And this statement has been working just fine for all other variables, and somehow for INT value, it does not work. I tried inserting the string variable instead of int, but doesn't work. Also tried to convert the value such as int(medDosage) to make sure it's the right type, but still doesn't work. I know my syntax is correct so I cannot really understand the error. Can you please help why this error is showing?
Thank you in advance.

You need to ensure the last argument is a tuple:
myCursor.execute("INSERT INTO dosage (dosageDesc) VALUES (%s)", (medDosage,))

How to decrypt one column of a SELECT * statement in Python?

I have a SELECT statement in MySQL that fetches all the rows that matches a criteria as follows:
SELECT * FROM table_name WHERE sl_no=number;
and the table structure is as follows:
--------------------------
sl_no|val_1|val_2|val_3
---------------------------
1|a|b|c
2|d|e|f
3|g|h|i
----------------------------
One of the columns, val_1 is encrypted. I need to decrypt this column when the SELECT query above is executed. I know how to do it in MySQL as below:
SET #key_str = key;
SET block_encryption_mode=aes-256-ecb;
SELECT AES_DECRYPT(FROM_BASE64(val_1), #key_str) FROM table WHERE sl_no=number;
I want to replicate the same process in Python using MySQLdb. My attempts:
I first tried the answer mentioned in this question, which did not work
I then tried to run the commands shown above in Python itself the following way
database = MySQLdb.connect(host=host_name,user=databaseUsername,passwd=databasePassword,db=databaseName,cursorclass=MySQLdb.cursors.DictCursor)
set_query="SET #key_str=(%s)%config['key_str']"
set_block="SET block_encryption_mode=(%s)config['aes_mode']"
database.query(set_query)
database.query(set_block)
However, I keep getting the following error: _mysql_exceptions.ProgrammingError: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near key_string at line 1"). for this line: set_query="SET #key_str=(%s)%config['key_str']

Error in SQL syntax while querying in MariaDB

I have a table named Container in mariadb having three fields container_id, mt_date and age.
What i am trying to do is, to update/set new values to the age field corresponding to the specific container_id, every time the db is loaded. I have kept the age and corresponding container_id in a python dictionary as a value and key, respectively. Than i loop through the dictionary and try to update age like this -
for i in list(age_dict):
frappe.db.sql("update Container set age = age_dict[i] where container_id = i")
Here, frappe.db.sql() is the db connecting command for my framework.
I am constantly getting this error message-
ProgrammingError: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '[i] where container_id = i' at line 1")
I have checked my sql query code several times, but couldn't find the syntax error. Looking for help.

The python code you have inside your SQL statement is never interpreted. The database is literally trying to execute the command update Container set age = age_dict[i] where container_id = i which is indeed invalid syntax. You should use parameterization, which will help prevent SQL injection and will easily format the SQL command. The syntax is almost identical to string interpolation, but you pass the values (as a tuple) as a second parameter to frappe.db.sql().
for key in list(age_dict):
frappe.db.sql(
"update Container set age = %s where container_id = %s",
(age_dict[key], key)
)