Re: String substitution VS proper mysql escaping

2010-09-04 Thread Aahz
In article , =?UTF-8?B?zp3Or866zr/Pgg==?= wrote: > >After all () used to define tuples and [] usedd to define lists. Why >commas? No, "()" does *not* define tuples, except for the empty tuple. The comma defines tuples, with parentheses simply used for visual effect: >>> 1, 2, 3 (1, 2, 3) -- A

Re: String substitution VS proper mysql escaping

2010-08-30 Thread John Nagle
On 8/30/2010 1:11 AM, Gregory Ewing wrote: Nik the Greek wrote: Yes i will i just asked to know if i were to substitute what might be the problem so to understand why i need the quoting. Because if you use % to build a query string, the result must be syntactically valid SQL. The values that

Re: String substitution VS proper mysql escaping

2010-08-30 Thread MRAB
On 30/08/2010 17:34, Alexander Kapps wrote: Nik the Greek wrote: cursor.execute(''' SELECT hits FROM counters WHERE page = %s and date = %s and host = %s ''' , a_tuple ) and cursor.execute(''' SELECT hits FROM counters WHERE page = %s and date = %s and host = %s ''' , (a_tuple) ) are both sy

Re: String substitution VS proper mysql escaping

2010-08-30 Thread MRAB
On 30/08/2010 17:09, Nik the Greek wrote: On 30 Αύγ, 11:11, Gregory Ewing wrote: Nik the Greek wrote: Yes i will i just asked to know if i were to substitute what might be the problem so to understand why i need the quoting. Because if you use % to build a query string, the result must be sy

Re: String substitution VS proper mysql escaping

2010-08-30 Thread Alexander Kapps
Nik the Greek wrote: cursor.execute(''' SELECT hits FROM counters WHERE page = %s and date = %s and host = %s ''' , a_tuple ) and cursor.execute(''' SELECT hits FROM counters WHERE page = %s and date = %s and host = %s ''' , (a_tuple) ) are both syntactically correct right? buw what about c

Re: String substitution VS proper mysql escaping

2010-08-30 Thread Nik the Greek
On 30 Αύγ, 11:11, Gregory Ewing wrote: > Nik the Greek wrote: > > Yes i will i just asked to know if i were to substitute what might be > > the problem so to understand why i need the quoting. > > Because if you use % to build a query string, the result must > be syntactically valid SQL. The value

Re: String substitution VS proper mysql escaping

2010-08-30 Thread Gregory Ewing
Nik the Greek wrote: Yes i will i just asked to know if i were to substitute what might be the problem so to understand why i need the quoting. Because if you use % to build a query string, the result must be syntactically valid SQL. The values that you substitute into the placeholders must en

Re: String substitution VS proper mysql escaping

2010-08-29 Thread Nik the Greek
On 30 Αύγ, 05:48, MRAB wrote: > On 30/08/2010 03:33, Nik the Greek wrote: > > > > > > > > > On 30 Αύγ, 05:04, MRAB  wrote: > > > when iam trying to pass a tuple to the execute methos should i pass it > > like this? > > > cursor.execute(''' SELECT hits FROM counters WHERE page = %s and > > date = %

Re: String substitution VS proper mysql escaping

2010-08-29 Thread MRAB
On 30/08/2010 03:33, Nik the Greek wrote: On 30 Αύγ, 05:04, MRAB wrote: when iam trying to pass a tuple to the execute methos should i pass it like this? cursor.execute(''' SELECT hits FROM counters WHERE page = %s and date = %s and host = %s ''' % (page, date, host) ) or like tuple = (page

Re: String substitution VS proper mysql escaping

2010-08-29 Thread Nik the Greek
On 30 Αύγ, 05:04, MRAB wrote: when iam trying to pass a tuple to the execute methos should i pass it like this? cursor.execute(''' SELECT hits FROM counters WHERE page = %s and date = %s and host = %s ''' % (page, date, host) ) or like tuple = (page, host, date) cursor.execute(''' SELECT hit

Re: String substitution VS proper mysql escaping

2010-08-29 Thread MRAB
On 30/08/2010 02:38, Νίκος wrote: On 29 Αύγ, 21:34, MRAB wrote: It likes the values to be in a tuple. If there's one value, that's a 1-tuple: (page, ). I noticed that if we are dealing with just a single value 'page' will do, no need to tuple for 1-value. it handles fine as a string. I tri

Re: String substitution VS proper mysql escaping

2010-08-29 Thread Νίκος
On 29 Αύγ, 21:34, MRAB wrote: > It likes the values to be in a tuple. If there's one value, that's a > 1-tuple: (page, ). I noticed that if we are dealing with just a single value 'page' will do, no need to tuple for 1-value. it handles fine as a string. > >> cursor.execute('''SELECT hits FROM

Re: String substitution VS proper mysql escaping

2010-08-29 Thread MRAB
On 29/08/2010 06:13, Νίκος wrote: On 28 Αύγ, 23:12, MRAB wrote: On 28/08/2010 20:51, Νίκος wrote: On 28 Αύγ, 22:35, MRABwrote: """When there's more than one value you provide a tuple. It's makes sense from the point of view of consistency that you also provide a tuple when ther

Re: String substitution VS proper mysql escaping

2010-08-28 Thread Νίκος
On 28 Αύγ, 23:12, MRAB wrote: > On 28/08/2010 20:51, Νίκος wrote: > > > > > > > > > > > On 28 Αύγ, 22:35, MRAB  wrote: > > >> """When there's more than one value you provide a tuple. It's makes sense > >> from the point of view of consistency that you also provide a tuple when > >> there's only on

Re: String substitution VS proper mysql escaping

2010-08-28 Thread MRAB
On 28/08/2010 20:51, Νίκος wrote: On 28 Αύγ, 22:35, MRAB wrote: """When there's more than one value you provide a tuple. It's makes sense from the point of view of consistency that you also provide a tuple when there's only one value.""" Can you write something that make use of more than one

Re: String substitution VS proper mysql escaping

2010-08-28 Thread MRAB
On 28/08/2010 20:48, Νίκος wrote: On 28 Αύγ, 22:35, MRAB wrote: On 28/08/2010 20:10, Νίκος wrote:> On 20 Αύγ, 09:04, Nik Grwrote: With regard to the "%" operator, it considers the string on the left to be a format string with multiple %blah things in it to replace. The thing on the right

Re: String substitution VS proper mysql escaping

2010-08-28 Thread Rami Chowdhury
2010/8/29 Νίκος : > On 28 Αύγ, 22:35, MRAB wrote: > >> """When there's more than one value you provide a tuple. It's makes sense >> from the point of view of consistency that you also provide a tuple when >> there's only one value.""" > > Can you write something that make use of more than one valu

Re: String substitution VS proper mysql escaping

2010-08-28 Thread Νίκος
On 28 Αύγ, 22:35, MRAB wrote: > """When there's more than one value you provide a tuple. It's makes sense > from the point of view of consistency that you also provide a tuple when > there's only one value.""" Can you write something that make use of more than one value? Perhaps you mena somet

Re: String substitution VS proper mysql escaping

2010-08-28 Thread Νίκος
On 28 Αύγ, 22:35, MRAB wrote: > On 28/08/2010 20:10, Νίκος wrote:> On 20 Αύγ, 09:04, Nik > Gr  wrote: > >> With regard to the "%" operator, it considers the string on the left to > >> be a format string with multiple %blah things in it to replace. The > >> thing on the right is a sequence of item

Re: String substitution VS proper mysql escaping

2010-08-28 Thread MRAB
On 28/08/2010 20:10, Νίκος wrote: On 20 Αύγ, 09:04, Nik Gr wrote: With regard to the "%" operator, it considers the string on the left to be a format string with multiple %blah things in it to replace. The thing on the right is a sequence of items to place into the format string. Can you plea

Re: String substitution VS proper mysql escaping

2010-08-28 Thread Νίκος
On 20 Αύγ, 09:04, Nik Gr wrote: > With regard to the "%" operator, it considers the string on the left to > be a format string with multiple %blah things in it to replace. The > thing on the right is a sequence of items to place into the format > string. Can you please clarify what you mean by th

Re: String substitution VS proper mysql escaping

2010-08-21 Thread Lawrence D'Oliveiro
In message , Νίκος wrote: > I would expect that: > > ("nikos") is a single element tuple. Then how would you do a simple parenthesized expression? -- http://mail.python.org/mailman/listinfo/python-list

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Nik Gr
Στις 20/8/2010 8:22 πμ, ο/η Cameron Simpson έγραψε: [...snip...] | Why does the page variable which is actually a string needs to be a | tuple or a list and not just as a string which is what it actually | is? With regard to the "%" operator, it considers the string on the left to be a format s

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Cameron Simpson
On 19Aug2010 21:50, Nik Gr wrote: | Στις 19/8/2010 6:58 μμ, ο/η Tim Chase έγραψε: | >It can be written as a non-3-quote string, you just have to escape | >the inner quotes (single & double) and the backslash to be seen: | > | > name = 'My name is "Nikos" and I\'m from Thessaloniki\\Greece' | >

Re: String substitution VS proper mysql escaping

2010-08-19 Thread John Nagle
On 8/18/2010 2:50 AM, Cameron Simpson wrote: On 18Aug2010 12:07, Nik Gr wrote: | Στις 18/8/2010 7:31 πμ, ο/η Cameron Simpson έγραψε: |>On 17Aug2010 20:15, Νίκος wrote: |>| === |>| cursor.execute( ''' SELECT host, hits, date FROM visitors WHERE page = |>| '%s' ORDER

Re: String substitution VS proper mysql escaping

2010-08-19 Thread MRAB
Nik Gr wrote: [snip] Why does the page variable which is actually a string needs to be a tuple or a list and not just as a string which is what it actually is? I have a strong desire to use it like this: cursor.execute( '''SELECT hits FROM counters WHERE page = %s''' , page ) opposed to tuple.

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Nik Gr
Στις 19/8/2010 6:58 μμ, ο/η Tim Chase έγραψε: It can be written as a non-3-quote string, you just have to escape the inner quotes (single & double) and the backslash to be seen: name = 'My name is "Nikos" and I\'m from Thessaloniki\\Greece' name = "My name is \"Nikos\" and I'm from Thessal

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Tim Chase
On 08/19/10 10:42, Nik Gr wrote: You can also prefix any of them with "r" such as file_path = r"c:\path\to\file.txt" file_path = r'c:\path\to\file.txt file_path = r"""c:\path\to\file.txt""" file_path = r'''c:\path\to\file.txt''' 'r' is to avoid escaping backslashes only or other sp

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Nik Gr
Στις 19/8/2010 2:32 μμ, ο/η Tim Chase έγραψε: (1,) + (2,) to return "(1,2)" This is actually joining two single element tuples (1,) and (2, ) to a new bigger tuple of two elements, correct? -- http://mail.python.org/mailman/listinfo/python-list

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Nik Gr
Στις 19/8/2010 2:32 μμ, ο/η Tim Chase έγραψε: So Python needs a way to express that you *explicitly* mean "this is one of those rare one-element tuples, not an order of operations prioritization": (1,) + (2,) to return "(1,2)" Yes i can see the difference now!! I just had to look at the big

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Stefan Schwarzer
Hi Νίκος, On 2010-08-19 09:10, Νίκος wrote: > On 18 Αύγ, 12:50, Cameron Simpson wrote: >> >> ("nikos",) is a single element tuple. >> ["nikos"] is a single element list. >> ["nikos",] is also a single element list, just written like the tuple. > > It makes more sense if i: > > "nikos" is just a

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Tim Chase
On 08/19/10 02:10, Νίκος wrote: ("nikos",) is a single element tuple. ["nikos"] is a single element list. ["nikos",] is also a single element list, just written like the tuple. It makes more sense if i: "nikos" is just a string ("nikos") is a single element tuple ["nikos"] is also a single ele

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Νίκος
On 18 Αύγ, 12:50, Cameron Simpson wrote: > > ("nikos",) is a single element tuple. > ["nikos"] is a single element list. > ["nikos",] is also a single element list, just written like the tuple. It makes more sense if i: "nikos" is just a string ("nikos") is a single element tuple ["nikos"] is

Re: String substitution VS proper mysql escaping

2010-08-19 Thread Νίκος
I would expect that: "nikos" is a string, while, ("nikos") is a single element tuple. ["nikos"] is a single element list. That way we wouldn't be needing comma seperators. I just don't like it when "nikos" and ("nikos") is the same thing exactly. Parentheses are to be used to define a tuple and s

Re: String substitution VS proper mysql escaping

2010-08-18 Thread Tim Chase
On 08/18/10 04:50, Cameron Simpson wrote: ("nikos",) is a single element tuple. ["nikos"] is a single element list. ["nikos",] is also a single element list, just written like the tuple. You don't see the ["nikos",] form very often because ["nikos"] is not ambiguous. I most frequently see/use

Re: String substitution VS proper mysql escaping

2010-08-18 Thread Cameron Simpson
On 18Aug2010 12:07, Nik Gr wrote: | Στις 18/8/2010 7:31 πμ, ο/η Cameron Simpson έγραψε: | >On 17Aug2010 20:15, Νίκος wrote: | >| === | >| cursor.execute( ''' SELECT host, hits, date FROM visitors WHERE page = | >| '%s' ORDER BY date DESC ''' % (page) ) | >| ==

Re: String substitution VS proper mysql escaping

2010-08-18 Thread Nik Gr
Στις 18/8/2010 7:31 πμ, ο/η Cameron Simpson έγραψε: On 17Aug2010 20:15, Νίκος wrote: | === | cursor.execute( ''' SELECT host, hits, date FROM visitors WHERE page = | '%s' ORDER BY date DESC ''' % (page) ) | === | | Someone told me NOT to d

Re: String substitution VS proper mysql escaping

2010-08-17 Thread Cameron Simpson
On 17Aug2010 20:15, Νίκος wrote: | === | cursor.execute( ''' SELECT host, hits, date FROM visitors WHERE page = | '%s' ORDER BY date DESC ''' % (page) ) | === | | Someone told me NOT to do string substitution ("%") on SQL statements | and to

Re: String substitution VS proper mysql escaping

2010-08-17 Thread Daniel Kluev
2010/8/18 Νίκος > a) I wanted to ask what is proper escaping mean and > > Proper escaping means that value is wrapped in quotes properly, and quotes and backslashes (or any other special to RDBMS symbol) are escaped with backslashes. why after variable page syntax has a comma > Comma just means

String substitution VS proper mysql escaping

2010-08-17 Thread Νίκος
=== cursor.execute( ''' SELECT host, hits, date FROM visitors WHERE page = '%s' ORDER BY date DESC ''' % (page) ) === Someone told me NOT to do string substitution ("%") on SQL statements and to let MySQLdb do it for me, with proper escaping