在Python中使用“”执行SQL

Question

I have trouble executing a SQL-statement from Python because of the " " in the selection. I think I've tried every combination, but can't figure it out. Can you please help me?

cnxn = pyodbc.connect("DRIVER={Microsoft Access Driver (*.mdb)};DBQ=c:\\python33\salesdb.mdb")
cursor = cnxn.cursor()
v_sql = "SELECT DISTINCT tblSeller.ID, tblSeller.Navn FROM tblResult INNER JOIN tblSeller ON tblResult.SellerID = tblSeller.ID WHERE (((tblSeller.Name)="Robert Smith" ))"
cursor.execute(v_sql)

The problem is the " around Robert Smith in the SQL.

Answer 1

You would escape the quotes or use a different quoting style. Single quotes would do here, for example.

Using single quotes:

v_sql = 'SELECT DISTINCT tblSeller.ID, tblSeller.Navn FROM tblResult INNER JOIN tblSeller ON tblResult.SellerID = tblSeller.ID WHERE (((tblSeller.Name)="Robert Smith" ))'

Using escaping:

v_sql = "SELECT DISTINCT tblSeller.ID, tblSeller.Navn FROM tblResult INNER JOIN tblSeller ON tblResult.SellerID = tblSeller.ID WHERE (((tblSeller.Name)=\"Robert Smith\" ))"

or you can use triple quotes (one of ''' or """ ); these allow for easy multi-line strings as newlines are allowed and included in the final string value:

v_sql = """
SELECT DISTINCT tblSeller.ID, tblSeller.Navn 
FROM tblResult INNER JOIN tblSeller ON tblResult.SellerID = tblSeller.ID
WHERE (((tblSeller.Name)=\"Robert Smith\" ))
"""

Answer 2

Try mixing with single quotes:

v_sql = "SELECT DISTINCT tblSeller.ID, tblSeller.Navn FROM tblResult INNER JOIN tblSeller ON tblResult.SellerID = tblSeller.ID WHERE (((tblSeller.Name)='Robert Smith' ))"

or

v_sql = 'SELECT DISTINCT tblSeller.ID, tblSeller.Navn FROM tblResult INNER JOIN tblSeller ON tblResult.SellerID = tblSeller.ID WHERE (((tblSeller.Name)="Robert Smith" ))'

In python strings can either be quoted with a doublequote " or a singlequote ' . This is very usefull in these cases.

Answer 3

In Python you can create string using ' or " as other says.

But in this case I would like to propose using PreparedStatement instead of simple query. Such PreparedStatement uses ? in place of arguments and arguments are simply array:

v_sql = "SELECT DISTINCT tblSeller.ID, tblSeller.Navn FROM tblResult INNER JOIN tblSeller ON tblResult.SellerID = tblSeller.ID WHERE (((tblSeller.Name)=?))"
rs = c.execute(v_sql, ["Robert Smith", ])

PreparedStatements have many advantages: they are simpler to database engines to parse, and cache query plans, they are SQLInjection attacks safe etc.