Python cx_oracle变量

Question

try:
for row in data:
    id = row[0]
    name= row[1]
    b.execute("INSERT INTO NAME (NUMBER, NAME, ID) VALUES (1, %s, %s)" %(name, id))
    conn.commit()
except: #rest code

I can not add values to the database (as much as I understand it is because of the name variable), I always receive this error: ORA-00936: missing expression . What is wrong in my code? How should i specify parameter correctly?

Answer 1

Use bind variables instead. Do not use %s and put the parameter directly in the string as this leads to possible SQL injection, not to mention quoting issues. This method permits passing any legal value without having to worry about such things!

try:
    for row in data:
        id = row[0]
        name= row[1]
        b.execute("INSERT INTO NAME (NUMBER, NAME, ID) VALUES (1, :1, :2)",
                (name, id))
    conn.commit()
except:
    # rest code