<html><body bgcolor="#FFFFFF"><div><span class="Apple-style-span" style="-webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); ">On Jun 23, 2010, at 9:12 AM, Paul Rubin <<a href="mailto:no.email@nospam.invalid">no.email@nospam.invalid</a>> wrote:</span><br>
</div><div><br></div><div></div><blockquote type="cite"><div><span>Stephen Hansen <<a href="mailto:me+list/python@ixokai.io">me+list/python@ixokai.io</a>> writes:</span><br><blockquote type="cite"><span>On 6/23/10 6:45 AM, Victor Subervi wrote:</span><br>
</blockquote><blockquote type="cite"><blockquote type="cite"><span> cursor.execute('select clientEmail from clients where client=%s', ...</span><br></blockquote></blockquote><blockquote type="cite"><span>Do, 'client.replace("_", " ")' instead.</span><br>
</blockquote><span></span><br><span>Er, look what happened to Little Bobby Tables (a quick web search on his</span><br><span>name should find his story) because someone wrote code like that.</span><br><span>Really, write the code a different way, with a prepared query.</span><br>
</div></blockquote><br><span class="Apple-style-span" style="font-size: medium; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); "><span>I think you misread. He is using parameterized queries-- just</span><br>
<span>incorrectly, as addressed later that you didn't quote. He isn't using</span><br><span>string formatting to generate the SQL. The mysql layer just uses %s as</span><br><span>a marker.</span><br><span></span><br>
<span>The line you did quote was just about using string methods for the</span><br><span>data to pass into the parameterized query-- not for SQL purposes but</span><br><span>just because the data in the table apparently has spaces and the data</span><br>
<span>in this part of his app has underscores. For some reason.</span><br><span></span><br><span>--Stephen</span></span><br></body></html>