Develop Reference

Using a variable for a table name with python sql cursor

I am using python sql cursor to dynamically access my database and I am in a situation where I want to use a variable in place of a table name. So far all of my attempts have resulted in syntax errors, although I (think?) I am doing things as expected? Unless a table name as a variable is different from a value as a variable:
here is what I currently have:
cursor.execute("INSERT INTO %s (word=%s,item_id=%s,word_tag=%s,unstemmed_word=%s, word_position=%s, TF=%s, normalized_term_frequency=%s, sentence=%s,anthology_id=%s) "%(table_name, stemmedWord,fle.split()[0], str(word[1]), uniqeWord, word_pos, TF, normalized_term_frequency, sentence, fle.split()[1].split(".")[0]))
and I have also tried this:
cursor.execute("INSERT INTO %s (word,item_id,word_tag,unstemmed_word, word_position, TF, normalized_term_frequency, sentence,anthology_id) values(%s, %s,%s, %s, %s, %s, %s, %s, %s)",(table_name, stemmedWord,fle.split()[0], str(word[1]), uniqeWord, word_pos, TF, normalized_term_frequency, sentence, fle.split()[1].split(".")[0]))

You cannot dynamically bind object names, only values. You'll have to resort to string manipulation for the table's name. E.g.:
sql = "INSERT INTO {} (word=%s,item_id=%s,word_tag=%s,unstemmed_word=%s, word_position=%s, TF=%s, normalized_term_frequency=%s, sentence=%s,anthology_id=%s)".format(table_name)
cursor.execute(sql % (stemmedWord,fle.split()[0], str(word[1]), uniqeWord, word_pos, TF, normalized_term_frequency, sentence, fle.split()[1].split(".")[0]))

If you are on python >= 3.6 this is probably better:
cursor.execute(f'INSERT INTO {table_name} (word="{stemmedWord}",item_id={fle.split()[0]},word_tag={str(word[1])},unstemmed_word="{oword_posrmuniqeWord}", word_position=word_pos, TF={TF}, normalized_term_frequency={normalized_term_frequency}, sentence="{sentence}",anthology_id={fle.split()[1].split(".")[0])}'
but I think your syntax errors are coming from two things:
you have provided a string to split fle on. (Correction this defaults to space - so is OK!)
you haven't quoted what seem to be obvious strings in you sql fields.

Cassandra's poorly design of table naming convention

Let a = "03bb2997_8b7a_4359_800d_7c14e5175bc9" and I decide to make it a table name of my cassandra. Hence, by using Python,
session.execute("""CREATE TABLE IF NOT EXISTS "%s" (date date, time time, input text, predicted_result text, PRIMARY KEY(date, time));""" % new_modelId)
Take note of the double quotes between %s, without it, the cql will complain SyntaxException: line 1:35 mismatched character '_' expecting '-' since the table name cannot start with numeric character
The table is created successfully. I verified it through cqlsh. However, when I try to insert data into the table with code below:
session.execute("""INSERT INTO "%s" (date, time, input, predicted_result) VALUES(%s, %s, %s, %s);""",
(a, str(dateTime.date()), str(dateTime.time()),
json.dumps(json.loads(input_json)["0"]), json.dumps(json.loads(predicted_result_json)["0"])))
InvalidRequest: Error from server: code=2200 [Invalid query] message="unconfigured table '03bb2997_8b7a_4359_800d_7c14e5175bc9'"
I tried with hardcoded table name and it works.
session.execute("""INSERT INTO "03bb2997_8b7a_4359_800d_7c14e5175bc9" (date, time, input, predicted_result) VALUES(%s, %s, %s, %s);""",
( str(dateTime.date()), str(dateTime.time()),
json.dumps(json.loads(input_json)["0"]), json.dumps(json.loads(predicted_result_json)["0"])))
I can't figure out what's wrong with Cassandra table naming. It is so confusing and frustrating.

You cannot parameterize keyspace or table name, only the parameters on prepared statements. How you execute it here is not a prepared statement, but your arguments to execute have been confused with how you put your parentheses. You are putting a with the first arg as part of a tuple, so I think it would work to:
session.execute("""INSERT INTO "%s" (date, time, input, predicted_result) VALUES(%s, %s, %s, %s);""",
a,
str(dateTime.date()),
str(dateTime.time()),
json.dumps(json.loads(input_json)["0"]),
json.dumps(json.loads(predicted_result_json)["0"])))
Also, you can always build string yourself as well:
session.execute("""INSERT INTO "%s" (date, time, input, predicted_result) VALUES('%s', '%s', '%s', '%s');""" %
(a,
str(dateTime.date()),
str(dateTime.time()),
json.dumps(json.loads(input_json)["0"]),
json.dumps(json.loads(predicted_result_json)["0"]))))
Generally its good practice to have hard coded table names for security implications.
As an aside, are you creating tables dynamically? This will eventually cause issues. Cassandra doesn't do well if it has thousands of tables and loading schema gets slower and slower as you make alterations (uses STCS).

Finally solved the problem by using an ugly way.
query = "INSERT INTO " + a
session.execute(query + """ (date, time, input, predicted_result) VALUES(%s, %s, %s, %s);""", (
str(dateTime.date()), str(dateTime.time()), json.dumps(json.loads(input_json)["0"]),
json.dumps(json.loads(predicted_result_json)["0"])))

SQLite3 near syntax error

Trying to insert four different things into my database but I get following error:
near ".10586": syntax error
Here is my code:
b.execute("INSERT INTO logs VALUES(%s, %s, %s, %s)" % (hostname, os, ip.decode('utf-8'), time.strftime("%x")))

Since you are constructing the query using string formatting, you need quotes around the placeholders - "%s" instead of %s.
Instead, make a parameterized query and pass the query parameters in a second argument to execute() - this way you would let the database driver worry about the type conversion and you would prevent SQL injection attacks. The change is as simple as:
b.execute("INSERT INTO logs VALUES(?, ?, ?, ?)",
(hostname, os, ip.decode('utf-8'), time.strftime("%x")))

How to handle apostrophes in MySQL-Python?

A Python API is giving back u"'HOPPE'S No. 9'" as a value for a particular product attribute. I'm then looking to insert it into the DB, also using Python (python-mysqldb), with the following query:
INSERT INTO mytable (rating, Name) VALUES('5.0 (7)', 'HOPPE'S No. 9';
MySQL rejects this, and the suggested approach to handling a single quote in MySQL is to escape it first. This I need to do in Python, so I try:
In [5]: u"'HOPPE'S No. 9'".replace("'", "\'")
Out[5]: u"'HOPPE'S No. 9'"
When I incorporate this in my program, MySQL still rejects it. So I double-escape the apostrophe, and then an insert happens successfully. Thing is, it contains the escape character (so what gets written is 'HOPPE\'S No. 9').
If I need the second escape character, but when I add it gets left in, then how can I handle the escaping without having the escape character included in the string that gets inserted?
Edit: Based on theBjorn's suggestion, tried:
actualSQL = "INSERT INTO %s (%s) VALUES(%s);"
#cur.execute(queryString)
cur.execute(actualSQL,
(configData["table"], sqlFieldMappingString, sqlFieldValuesString))
but it looks like I'm back to where I was when I was trying to escape using the single escape with .replace():
Error 1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''mytable' ('rating, Name, Image, mfg, price, URL') VALUES('\'5.0 (3)\', \'AR-1' at line 1

You should never construct sql that way. Use parameterized code instead:
cursor.execute(
"insert into mytable (rating, name) values (%s, %s);",
("5.0 (7)", "HOPPE'S No. 9")
)
your latest problem is due to the misconception that this is string interpolation, which it isn't (the use of %s is confusing), thus:
actualSQL = "INSERT INTO %s (%s) VALUES(%s);"
will be wrong. It is possible to construct your sql string, but probably easier to do so in two steps so we don't trip over sql parameter markers looking like string interpolation markers. Assuming you have the values in a tuple named field_values:
params = ["%s"] * len(field_values) # create a list with the correct number of parameter markers
sql = "insert into %s (%s) values (%s)" % ( # here we're using string interpolation, but not with the values
configData["table"],
sqlFieldMappingString,
', '.join(params)
)
if you print sql it should look like my example above. Now you can execute it with:
cursor.execute(sql, field_values)

Using prepared statements with mysql in python

I am trying to use SQL with prepared statements in Python. Python doesn't have its own mechanism for this so I try to use SQL directly:
sql = "PREPARE stmt FROM ' INSERT INTO {} (date, time, tag, power) VALUES (?, ?, ?, ?)'".format(self.db_scan_table)
self.cursor.execute(sql)
Then later, in the loop:
sql = "EXECUTE stmt USING \'{}\', \'{}\', {}, {};".format(d, t, tag, power)
self.cursor.execute(sql)
And in the loop I get:
MySQL Error [1064]: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''2014-12-25', '12:31:46', 88000000, -6.64' at line 1
What's going on?

Using prepared statements with MySQL in Python is explained e.g at http://zetcode.com/db/mysqlpython/ -- look within that page for Prepared statements.
In your case, that would be, e.g:
sql = ('INSERT INTO {} (date, time, tag, power) VALUES '
'(%s, %s, %s, %s)'.format(self.db_scan_table))
and later, "in the loop" as you put it:
self.cursor.execute(sql, (d, t, tag, power))
with no further string formatting -- the MySQLdb module does the prepare and execute parts on your behalf (and may cache things to avoid repeating work needlessly, etc, etc).
Do consider, depending on the nature of "the loop" you mention, that it's possible that a single call to .execute_many (with a sequence of tuples as the second argument) could take the place of the whole loop (unless you need more processing within that loop beyond just the insertion of data into the DB).
Added: a better alternative nowadays may be to use mysql's own Connector/Python and the explicit prepare=True option in the .cursor() factory -- see http://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursorprepared.html . This lets you have a specific cursor on which statements are prepared (with the "more efficient than using PREPARE and EXECUTE" binary protocol, according to that mysql.com page) and another one for statements that are better not prepared; "explicit is better than implicit" is after all one of the principles in "The Zen of Python" (import this from an interactive prompt to read all those principles). mysqldb doing things implicitly (and it seems the current open-source version doesn't use prepared statements) can't be as good an architecture as Connector/Python's more explicit one.

import mysql.connector
db_con=mysql.connector.connect(host='',
database='',
user='',
password='')
cursor = db_con.cursor(prepared=True,)
#cursor = db_con.cursor(prepared=True)#IT MAY HAVE PROBLEM
sql = """INSERT INTO table (xy,zy) VALUES (%s, %s)"""
input=(1,2)
cursor.execute(sql , input)
db_con.commit()
SELECT STMT
sql = """SELECT * FROM TABLE WHERE XY=%s ORDER BY id DESC LIMIT 1 """
ID=1
input=(ID,)
#input=(ID)# IT MAY HAS PROBLEM
cursor.execute(sql, input)
data = cursor.fetchall()
rowsNumber=cursor.rowcount

Python does support prepared statements:
sql = "INSERT INTO {} (date, time, tag, power) VALUES (%s, %s, %s, %s);"
sql = sql.format(self.db_scan_table)
self.cursor.execute(sql, (d, t, tag, power))
(You should ensure self.db_scan_table is not vulnerable to SQL injection)
This assumes your paramstyle is 'format', which it should be for MySQL.