sql更新集？ =？ 在哪 =？ （python，sqlite3）

Question

Python, slite3

c.execute("UPDATE accounts SET ? = ? WHERE num=?", (db['choise'], db['data'], db['num']))

so i don't know what is wrong with it

db is shelve database

Answer 1

The column (and table) names cannot be parameterized . Use string formatting for it and query parameterization for the rest of variables:

c.execute("UPDATE accounts SET {column} = ? WHERE num = ?".format(column=db['choise']), (db['data'], db['num']))

That said, make sure you properly validate/sanitize/escape the db['choise'] value or really trust the source of it (though don't trust anyone when it comes to database interactions).

Answer 2

Column names cannot be given as arguments. You can try

c.execute("UPDATE accounts SET "+str(db['choise'])+" = ? WHERE num=?", (db['data'], db['num']))