Problem Using SQL Placeholder In MySQL Query

[AdeS]

cur = conn.cursor()
    
# Select query 
cur.execute(f"SELECT studentnr, score FROM allstudentsAnswers{clas} WHERE weeknr = '{weeknr}'") 

...

cur = conn.cursor()
    
# Select query 
cur.execute(f"SELECT * FROM tbl_colours WHERE pc_name = '{mycmb}'") 
output = cur.fetchall() 

Please don't advise people to use string interpolation (or concatenation) in SQL queries as that is vulnerable to SQL injection. Parameterised queries are the correct way to do it, as they give the database a chance to validate the input.

Hi Pedroski55

I will try your solution but this is the one I found and it works a treat:

mysql = "SELECT * FROM tbl_colours WHERE pc_name = %(pc_name)s"

mycursor.execute(mysql, {'pc_name': mycmb})

Cheers

[Pedroski55]

Glad to hear that!

For me, security is not an issue, I only have homework on my webpage.

I once asked on phphelp.com if they could show me an SQL injection attack to meltdown my database, but no one answered.

But I'm sure it is wise to consider security.

Check out the link I posted, here it is again.

Looks very good!