python - pysqlite: Placeholder substitution for column or table names? -

python - pysqlite: Placeholder substitution for column or table names? -

using pysqlite making procedure data. same kind of operation done on similar fields in multiple tables , columns, thought parameterize sql statement shown below:

def foo(): column = 'c' table = 't' row = 1 # preferred approach, gives syntax error c.execute('select ? ? id=?', (column, table, row)) # sanity check, works fine c.execute('select c t id=?', (row)) # workaround, works, right way? c.execute('select % % id=?' % (column, table), row))

the error not helpful (sqlite3.operationalerror: near "?": syntax error), point: pysqlite not appreciate placeholders beingness used in way.

can point out going on here along proper way of doing above?

you can not utilize placeholders column or table names. don't have authoritative citation -- "know" having tried , failing. makes sense though:

if columns , table parametrized, there little purpose preparing (execute-ing) sql statement before fetching, since parts of statement replaced. i'm not sure pysqlite1, mysqldb automatically quotes string parameters. column , table names should not quoted. complicate parsing required driver if had decide if placeholder represented column or table name versus value needs quoting.

in short, you've found right way -- utilize string formating.

c.execute('select {} {} id=?'.format(column, table), row))

1 not drivers quote parameters -- oursql doesn't, since sends sql , arguments server separately.

python sql sqlite3 pysqlite