从数据帧创建逗号分隔列表以传递到 SQL 查询时出错

Question

I am trying to create a comma separated list to pass SQL query.

my code

sql1 = '''select carrier_name, carrier_account, invoice_number, invoice_amount, currency, invoice_date
from invoice_summary where invoice_number in {}'''.format(tuple(data1['invoice_number'].values.tolist()))

Current Output

    "select carrier_name, carrier_account, invoice_number,
 invoice_amount, currency, invoice_date\nfrom invoice_summary where invoice_number in ('BHX3327983',)"

Expected Output "

select carrier_name, carrier_account, invoice_number,
     invoice_amount, currency, invoice_date\nfrom invoice_summary where invoice_number in ('BHX3327983')"

I am looking for a solution that works when there is single input or there mutliple inputs to be passed.

Whats wrong in my code.

Answer 1

Try using join and put the parenthesis inside the string:

sql1 = '''select carrier_name, carrier_account, invoice_number, invoice_amount, currency, invoice_date
from invoice_summary where invoice_number in ({})'''.format(','.join(["'{}'".format(x) for x in data1['invoice_number']]))

---

Update

You could use the DataFrame.empty property to conditionally set the value of the sql statement. If data1 is empty, then set your WHERE clause to something that is False, eg 1 = 0 :

if data1.empty:
    sql1 = '''select carrier_name, carrier_account, invoice_number, invoice_amount, currency, invoice_date
              from invoice_summary where 1 = 0'''
else:
    sql1 = ('''select carrier_name, carrier_account, invoice_number, invoice_amount, currency, invoice_date
              from invoice_summary where invoice_number in ({})'''
            .format(','.join(["'{}'".format(x) for x in data1['invoice_number']])))

Answer 2

To avoid SQL-injection you could use this:

invoice_nums_list = data1['invoice_number'].values.tolist()

sql1 = '''select carrier_name, carrier_account, invoice_number, invoice_amount, currency, invoice_date from invoice_summary where invoice_number in ''' + 
       '(' + ','.join('%s' for i in range(len(invoice_nums_list))) + ')'

print(sql1)

cursor.execute(sql1, params=tuple(invoice_nums_list))