Using strings with ' in them in SQL-queries

Aahz Maruch aahz at
Tue May 30 22:33:20 CEST 2000

In article <39342055.1301760 at>,  <thomas at> wrote:
>I need to insert strings with ' in them in query-strings. I`m using
>the PostgreSQL-database. 
>If I try stuff like this :
>db = _pg.connection(....)
>db.query('insert into test (id, name) value (1, 'fdsfds''fdsf') ')
>That works ok. But the string I need to insert I get from a variable. 
>I cannot seem to use a variable in the query-string. Is there any way
>around this? How can I handle characters in strings that may
>comprimise the requirements of a valid sql-statement??

def sqlize(s):
  return string.replace(s,"'","''")

db.query("insert into test (name) value ('%s')" % sqlize(foo))
                      --- Aahz (Copyright 2000 by aahz at

Androgynous poly kinky vanilla queer het    <*>
Hugs and backrubs -- I break Rule 6

Have you coined a word today?  --Aahz

More information about the Python-list mailing list