mysql - Problems with Quotes in python twitter streamer -


user = "'" + "@%s" % data['user']['screen_name'] + "'" coordinates = "'" + ",".join(str(e)for e in data['coordinates']['coordinates']) + "'" tweet = "'" + data['text'].encode("ascii", "ignore") + "'" query = "insert tweets (location, tweet, author) values (" + coordinates + "," + tweet + "," + user + ")" 

i have having issues tweets are passed in have apostrophe (') or random quote marks breaks insert query. advice appreciated reduce errors tweets inserting. thanks

sample error message:

(1064, "you have error in sql syntax; check manual corresponds mysql server version right syntax use near 's stadium https://t.co/uj2u2tcxlr','@pucker21')' @ line 1") 

this 1 of reasons why you should not manually construct query via string interpolation.

instead, let database driver handle it:

query = """     insert         tweets          (location, tweet, author)      values          (%s, %s, %s) """ cursor.execute(query, (coordinates, tweet, user)) 

here creating parameterized query, %s placeholders database driver fill. mysql driver handle proper quoting, escaping , making query safe sql injections.


Comments

Popular posts from this blog

javascript - jQuery: Add class depending on URL in the best way -

caching - How to check if a url path exists in the service worker cache -

Redirect to a HTTPS version using .htaccess -