%d format: a number is required, not str #1151

XPPA0215 · 2023-12-06T08:43:25Z

XPPA0215
Dec 6, 2023

Code:

...
sql = '''SELECT aa, bb, refresh_time FROM table_name_%03d WHERE id = %s ORDER BY refresh_time DESC'''
...
            cursor.execute(sql, ((id / 10) % 1000), id)
            data = cursor.fetchall()

Additional context
I konw,PyMySQL convert all objects including integer to formatted and quoted string.
But when my table name is table_name_003.I expected it to be table_name_003 but I got table_name_'003'
I have also tried to make mysql not add automatically ''.But I failed.
Do you have any good suggestions, please

Answered by methane

Dec 7, 2023

(id / 10) % 1000) never have SQL injection risk.
Do not use untrusted input for table name, off course.

View full answer

methane · 2023-12-06T10:48:35Z

methane
Dec 6, 2023
Maintainer

Do not use placeholders for regular string interpolation. Use Python features instead.

5 replies

XPPA0215 Dec 7, 2023
Author

Thanks for reply，Your suggestion is to use f"...%(name)s..."？
I tried, too.But here's what I got: select * from 'table_name'.
This is wrong

methane Dec 7, 2023
Maintainer

...
table_name = "table_name_%03d" % ((id / 10) % 1000)
sql = f'''SELECT aa, bb, refresh_time FROM {table_name} WHERE id = %s ORDER BY refresh_time DESC'''
...
            cursor.execute(sql, (id,))
            data = cursor.fetchall()

XPPA0215 Dec 7, 2023
Author

Thanks, it's not a problem to handle in python.
However, this approach still carries the risk of SQL injection.
While in the majority of scenarios, the use of ID is reliable.

methane Dec 7, 2023
Maintainer

(id / 10) % 1000) never have SQL injection risk.
Do not use untrusted input for table name, off course.

Answer selected by XPPA0215

XPPA0215 Dec 7, 2023
Author

I understand. Thank you for your reply

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

%d format: a number is required, not str #1151

{{title}}

Replies: 1 comment 5 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

%d format: a number is required, not str #1151

XPPA0215 Dec 6, 2023

Replies: 1 comment · 5 replies

methane Dec 6, 2023 Maintainer

XPPA0215 Dec 7, 2023 Author

methane Dec 7, 2023 Maintainer

XPPA0215 Dec 7, 2023 Author

methane Dec 7, 2023 Maintainer

XPPA0215 Dec 7, 2023 Author

XPPA0215
Dec 6, 2023

Replies: 1 comment 5 replies

methane
Dec 6, 2023
Maintainer

XPPA0215 Dec 7, 2023
Author

methane Dec 7, 2023
Maintainer

XPPA0215 Dec 7, 2023
Author

methane Dec 7, 2023
Maintainer

XPPA0215 Dec 7, 2023
Author