Heather Coppersmith wrote:
[color=blue]
> On Sun, 17 Aug 2003 12:37:19 +1000,
> "Alastair G. Hogge" <agh@tpg.com.au> wrote:
>[color=green]
>> Sean Ross wrote:[color=darkred]
>>>
>>> "Alastair G. Hogge" <agh@tpg.com.au> wrote in message
>>> news:3f3b9080@dnews.tpgi.com.au...
>>>> So basicly final_qu would be
>>>> ('1','two','hello','2003-08-14','23:32:07') However has stated above
>>>> type(final_qu) return tuple.
>>>
>>> If final_qu is already a tuple of strings, and what you need is one
>>> string with each string in the tuple concatenated, then you can do this:
>>>
>>>>>> final_qu = ('1','two','hello','2003-08-14','23:32:07')
>>>>>> final_qu_str = ' '.join(final_qu)
>>>>>> final_qu_str
>>> '1 two hello 2003-08-14 23:32:07'
>>>>>>
>>>
>>> If you can't guarantee that each tuple element is a string, try this:
>>>>>> final_qu_str = ' '.join([str(e) for e in final_qu])
>>>>>> final_qu_str
>>> '1 two hello 2003-08-14 23:32:07'
>>>>>>
>>>
>>> [str(e) for e in final_qu] creates a list of a strings from the elements
>>> [in
>>> final_qu.
>>>
>>> HTH
>>> Sean[/color]
>> OK. Sorry I didn't quite make myslef clear.
>> final_qu is a string for pydb. The string should be something link:
>> INSERT INTO foo VALUES "('1','two','hello','2003-08-14','23:32:07')"
>> I need the () and each value must be inclosed in '' for the database
>> interface.[/color]
>
> Having just been through this myself, you're playing with fire: what if
> one of those strings contains a quote character (single or double)?
>
> Let the database interface do the quoting for you. I don't know what
> your table looks like, but I see two possibilities (all code untested):
>
> If your table contains a single column in which you're trying to put
> that whole string:
>
> sql = """INSERT INTO foo VALUES (%s)"""
> params = (repr( final_qu ),) # "str" may work here, too
> pydbcursor.execute( sql, params )
>
> If your table contains five columns, one for each element of that tuple:
>
> sql = """INSERT INTO foo VALUES (""" \
> + ','.join( ['%s'] * len( final_qu ) ) \
> + """)"""
> params = final_qu
> pydbcursor.execute( sql, params )
>
> HTH,
> Heather
>[/color]
OK I removed the all the 's from the string.
But now I get this:
<error>
raise DatabaseError, "error '%s' in '%s'" % ( msg, sql ), referer:
http://nova/~agh/house.html
pgdb.DatabaseError: error 'ERROR: parser: parse error at or near ":" at
character 155, referer:
http://nova/~agh/house.html
' in 'INSERT INTO house VALUES
(1,two,three,four,five,six,seven,eight,nine,ten,el even,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26, 27,28,29,30,N/A,2003-08-18,13:19:06)',
referer:
http://nova/~agh/house.html
</error>
As my modifed code:
<code>
#!/usr/local/bin/python
import cgi
import time
import pgdb
def Initialise():
_dbuser = "agh"
_dbsource = "127.0.0.1:foo" # dsn.
_dbname = "foo"
return (pgdb.connect(dsn=_dbsource, user=_dbuser, database=_dbname))
def AddData(query):
db = Initialise()
cur = db.cursor()
cur.execute(query)
db.commit()
cur.close()
db.close()
# Begin
form = cgi.FieldStorage() # Grab the data from web page form
qu = ""
# Now we put all the form data into one big string for the db query.
for name in form.keys():
if form[name].value == "Submit":
qu += str(time.strftime("%Y-%m-%d")) + "," +
str(time.strftime("%H:%M:%S"))
break
else:
qu += form[name].value + ","
StoreData.AddData("INSERT INTO house VALUES (%s)" % (qu))
DisplayContent.WebPage(qu)
</code>
