使用python将带有特殊字符的值插入mysql表时出错

Question

Having an issue inserting a value into a mysql table using a dynamic list. I keep having a problem with the quotes pointing to a table instead of a value.

Here is the code:

lst = ['Pid', 'Base', 'Size', 'LoadCount', 'Path','Casename']
lst2 =['888', '1213726720', '61440', '65535', '\\SystemRoot\\System32\\smss.exe', 'wean']

table_name ="test"
insert_intotable = "INSERT INTO "  + table_name + "(" + ",".join(lst) + ") VALUES (" + ",".join(lst2) + ")"
print insert_intotable
c.execute(insert_intotable)
conn.commit()
c.close()
conn.close()

This causes the following error:

> Traceback (most recent call last):   File "pp.py", line 53, in
> <module>
>     c.execute(insert_intotable)   File "/usr/lib/python2.7/dist-packages/MySQLdb/cursors.py", line 174, in
> execute
>     self.errorhandler(self, exc, value)   File "/usr/lib/python2.7/dist-packages/MySQLdb/connections.py", line 36, in
> defaulterrorhandler
>     raise errorclass, errorvalue
> _mysql_exceptions.ProgrammingError: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server
> version for the right syntax to use near
> '\\SystemRoot\\System32\\smss.exe,test)' at line 1")

What is causing this syntax issue?

Answer 1

Use 'single quotes' when inserting string values

UPD:

Change second line to this

 lst2 =['888', '1213726720', '61440', '65535', '\'\\SystemRoot\\System32\\smss.exe\'', '\'wean\'']

Because, it is wrong SQL query:

 INSERT INTO test (Path) VALUES(\SystemRoot\System32\smss.exe)

And your code generates such query.

You should quote varchar values:

 INSERT INTO test (Path) VALUES('\SystemRoot\System32\smss.exe')