42000您的SQL语法错误； 检查与您的MySQL服务器相对应的手册

Question

I'm having trouble with my Python odbc code. I don't get this following code to work:

temp=process_query("SELECT FName, LName FROM Employee WHERE SSN='%s'" %i)

known_hours=process_query("SELECT DISTINCT Coalesce(Hours,0) 
FROM Works_On WHERE ESSN='%s'" %i)

 temp.append(known_hours)

where process_query takes the form:

def process_query(query):
    cursor1.execute(str(query))

(process_query continues some more but that is merely for printing purposes, when I've searched the web for my problem it seems that the problem lies within how I call the execute function so I omitted the rest of the function here).

The error I receive when I'm trying to execute this program is:

pyodbc.ProgrammingError: ('42000', "[42000] [MySQL][ODBC 5.1 Driver][mysqld-5.1.66-0+squeeze1-log]You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'John', [Decimal('32.5'), Decimal('7.5')], 'Yes']'' at line 1 (1064) (SQLExecDirectW)")

PS. If someone knows how to omit the "Decimal" when I'm printing and instead just have for instance 32.5 that would be appreciated as well to get help with.

Also I know that it has been several topics regarding this, but I am yet to see and understand the problem I have for a select statement.

Edit

Regarding how "i" is implemented it is as following:

I have an initial list called theList which contains all relevant social security numbers, SSN, which I then "loop" through like this:

for i in theList:

    temp=process_query("SELECT FName, LName FROM Employee WHERE SSN='%s'" %i)

    known_hours=process_query("SELECT DISTINCT SUM(Coalesce(Hours,0)) FROM Works_On WHERE ESSN='%s'" %i)

    temp.append(known_hours)
    unknown_hours=process_query("SELECT Distinct COUNT(*) FROM Works_On WHERE ISNULL(Hours) AND ESSN='%s'" %i)

    temp.append(unknown_hours)

Edit

I've changed it as beargle suggested. However I now run into another error namely that since I loop through i (the social security numbers) in theList I have to define these before.

Hence I use the line

theList=process_query('SELECT DISTINCT SSN FROM Employee', None)

Where I've updated my process_query to:

def process_query(query, parameters):

    if(parameters is None):

        cursor1.execute(query)

    else:

        cursor1.execute(query, parameters)  (*)

    n=0

    lista = []

    while 1:

        row = cursor1.fetchone()        

        if not row:

            break

        lista.append(row[0])

        n = n+1

    if n==0:

        print "No tuples matching the given query were found."

    return lista    

The trouble now is that the program complains at the second cursor1.execute (marked with a asterix, *) that ('The SQL contains 1 parameter markers, but 4 parameters were supplied', 'HY000') which I believe stems from that i is a social secuirity number and thus is not a single digit integer, but I cannot understand how to fix this issue.

I now call my as:

temp=process_query('SELECT FName, LName FROM Employee WHERE SSN= ?', i)

known_hours=process_query('SELECT DISTINCT SUM(Coalesce(Hours,0)) FROM Works_On WHERE ESSN=?', i)

the i's in theList is identified before the loop defining temp and such as follows:

theList=process_query('SELECT DISTINCT SSN FROM Employee', None)

which removed all other errors but got me a new one as stated previously. Also, I tried to convert the "i" to int(i) and map(int,i) without getting a release from my error.

Answer 1

Use query parameters in the cursor.execute() call of your process_query function. This will handle any escaping issues (protecting your code against SQL injection) and promotes statement preparation .

Change the process_query function to accept two parameters, one for the SQL string (containing parameter value placeholder) and one for parameter values:

def process_query(sql, params):
    cursor1.execute(sql, params)

The for loop would then change to:

for i in theList:
    temp=process_query('SELECT FName, LName FROM Employee WHERE SSN=?', i)
    known_hours=process_query('SELECT DISTINCT SUM(Coalesce(Hours,0)) FROM Works_On WHERE ESSN=?', i)
    temp.append(known_hours)
    unknown_hours=process_query('SELECT Distinct COUNT(*) FROM Works_On WHERE ISNULL(Hours) AND ESSN=?', i)
    temp.append(unknown_hours)

If this doesn't resolve the syntax problem, update your question with the query string causing the problem.