problems to add a string on mysql query result with python

Question

I want to add a string to the result of my query in mysql.

I tried this code:

mensaje = input ("introduzca el sms que desea enviar: ")
cursorsql1 = conectar.cursor()
sql = "select msisdn, '(mensaje)'VALUES(%s) as mensaje from perfiles where tarifa not like '%Iot%' and transparent_properties not like '%Momo%' and state like '%active%' and msisdn like '56943404789' and created_at between subdate(current_date, 1) and current_date".format(mensaje, values)
cursorsql1.executemany(sql,mensaje)
columnas = cursorsql1.fetchall()
print(columnas)

the error is this

mysql.connector.errors.ProgrammingError: Parameters for query must be list or tuple.

i want the results looks like this

| 56953404789 | some message  |

Any idea what is happening to cause my error?

Thanks in advance for any help

Try putting your parameter as a list: cursorsql1.executemany(sql, [mensaje]) — Peter
– Peter, Commented Nov 6, 2019 at 15:12
mysql.connector.errors.ProgrammingError: Failed executing the operation; Could not process parameters :( — Julio Cesar Arenas
– Julio Cesar Arenas, Commented Nov 6, 2019 at 15:16

Muhammed B. Aydemir · Accepted Answer · 2019-11-28 08:16:10Z

1

EDIT: Provided the injection safe method:

Use the sql CONCAT function:

sql = "SELECT CONCAT(msisdn, ?) AS mensaje FROM perfiles"
cursorsql1.execute(sql, (mensaje,))

Note that on sqlite there is no CONCAT function, instead use the || operator:

"SELECT msisdn || ? AS mensaje FROM perfiles"

edited Nov 28, 2019 at 8:16

answered Nov 6, 2019 at 15:22

Muhammed B. Aydemir

1,01510 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Julio Cesar Arenas Over a year ago

thankkkkss this work in this way: "SELECT msisdn, '{}' as mensaje from....".format(mensaje)

Peter Over a year ago

For the record that's very dangerous if you're designing it for other people to use, it's prone to SQL injection attacks.

Julio Cesar Arenas Over a year ago

Thank you for the warning but it is for my personal use :)

Collectives™ on Stack Overflow

problems to add a string on mysql query result with python

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related