is this a good way to catch exceptions?

[korenron]

really ?
Beacuse this is how I ahve done this for more then 1 year on 5-6 codes
didn't have any problems
I will have a look - but if you can point me to what will be better to do - it will be great

Thanks ,

[ndc85430]

SQL injection is a real thing, yes. Maybe your level of risk is low for whatever reason (no-one else can run these scripts, they aren't accessible in a way where the input can't be verified, ...), but given that it's so easy to do this properly, there isn't any reason not to. You can educate yourself on SQL injection and as I mentioned before, check the documentation for your database driver to see how to parameterise the queries correctly (it's not obvious which DB you're using).

[korenron]

I'm using mysql DB
and the only different I'm seeing is in the writing without '+' and using '%'

("INSERT INTO salaries "
              "(emp_no, salary, from_date, to_date) "
              "VALUES (%(emp_no)s, %(salary)s, %(from_date)s, %(to_date)s)")

this is what you mean?

I can change my code to this - if it's the right\acceptable way to write.

[ndc85430]

That looks like the right idea, yes. The docs should show you the call to execute as well where you actually pass the values for those parameters.

[hussaind]

Finally, I have found something which helped me. Many thanks!