如何在 Python flask 中编写删除 postgresql 查询

Question

I was trying to delete from a database table using flask and postgresql, but I keep having error in mysql syntax.Please how can I implement it. The two ways below did not work. Nb: The id is to be retrieved from a variable. I'm actually new to python from php.

my_id = 3
del = engine.execute("DELETE FROM my_table WHERE id = '{my_id}'")
del = engine.execute("DELETE FROM my_table WHERE id=:id", {"id":my_id})

Answer 1

You could just do this:

my_id = 3
result = engine.execute("DELETE FROM my_table WHERE id = %s", my_id)

or

result = engine.execute("DELETE FROM my_table WHERE id = %(id)s", id=my_id)

In both of these statements you are assuming that the underlying database connection library (for example psycopg2 or pg8000) are using %-formatting to bind query parameters. To avoid this dependency you can use sqlalchemy.text to build the query string:

import sqlalchemy as sa
result = engine.execute(sa.text("DELETE FROM my_table WHERE id = :id"), id=my_id)

letting sqlalchemy build the query and handle parameter binding and quoting.

You should NOT use ordinary python string formatting functions to bind query parameters:

engine.execute("DELETE FROM my_table WHERE id = %s" % my_id)
engine.execute("DELETE FROM my_table WHERE id = {}".format(my_id))
engine.execute(f"DELETE FROM my_table WHERE id = {my_id}")

Using these methods may expose your application to SQL injection attacks, because the query parameters may not be quoted correctly.

Finally, a point of style: you can't use del as a variable name. Python already has the del statement , and attempting to reassign the name del results in a SyntaxError . Also, the ResultProxy object returned by a DELETE statement doesn't contain any rows, so there is little point assigning the result to a variable.

Answer 2

Using SQLAlchemy.ORM

my_id = XXX
db.session.query.filter(Table.id == my_id).delete()
db.session.commit()

Answer 3

There are several ways to build up strings in python, if you're using python3 then I would use f-strings, which your second line of code is almost using. You just need to add an "f" before your quotes, so your code becomes:

del = engine.execute(f"DELETE FROM my_table WHERE id = '{my_id}'")

Here is some info on formatting strings in python and using f-strings https://realpython.com/python-f-strings/