python- sqlite3.OperationalError：“ <”附近：语法错误

Question

I am using python 3.6. When I try to implement this, at line: cursor=conn.execute(cmd) it raises an error as title, can any one help me? Thank you a lot.
Edit: I have found the solution by just editing str(id) to str(Id)

def getProfile(id):
    conn=sqlite3.connect("FaceBase.db")
    cmd="SELECT * FROM People WHERE ID=" +str(id)
    cursor=conn.execute(cmd)
    profile=None
    for row in cursor:
       profile=row
    conn.close()
    return profile

Answer 1

The error of your query is that you don't include the quotation marks inside the cmd which are needed if your argument is a string. It should have been like this:

cmd="SELECT * FROM People WHERE ID='{}'".format(str(id))

As @Aaron_ab mentioned on the comment. You should never use SQL queries like this because a malicious user can do SQL Injection. For example, if he puts as an ID 1' OR 1=1 /* it will return all the rows of the table.

Always, try to use prepared statements that don't allow users to forge their own SQL statement. An example:

cmd="SELECT * FROM People WHERE ID=%s"
curs.execute(cmd, (str(id),))