为什么我的带变量的function不更新数据？

Question

def overwriteFlat(top, curTable, rawEntrylist, columns): 
    rawEntrylist = rawEntrylist
    entryList = list()
    for value in rawEntrylist:
        entryList.append(value.get())  
    conn = sqlite3.connect('data.db')
    c = conn.cursor()
    for i in range(len(columns)):
        if entryList[i] != '':
            c.execute("""UPDATE """+curTable+""" SET """+columns[i]+""" = :"""+columns[i]+""" WHERE """+columns[0]+""" = """ + str(entryList[0]), {columns[i]: entryList[i]})
            print(curTable,columns[i],entryList[i])
            conn.commit()
    c.close()
    conn.close() 
    closeWin(top)

Output:

Flat ID 23
Flat Street Test
Flat Street_Number 100

I put in "Test" and "100" so that works. I provide a window for input, the input gets put into here and everything provided gets overwritten in provided ID. Because of print() I see it goes into the right table, it also selects the right column and doesn't throw any exception. But it doesn't update database.

• Database not locked.
• Variables all valid and work.
• No exception is thrown.
• Vulnerable to injection, soon as it works I'll change it.

Answer 1

Thanks to @JohnGordon i found the solution

But just so if someone wants to use Variables in Sqlite i will explain how as this is hardly explained anywhere on the Inte.net (at least at my Beginner-Programmer-Level)

Usually Sql commands work like this and are pretty static:

"UPDATE Your_Table SET Your_Column = :Your_Column WHERE IndexColumn = Your_Index), {Your_Column: Your_Value}"

But by using +Variable+ you can use Variables in there so its the same thing but with whatever Variable you want:

"UPDATE "+curTable+" SET "+columns[i]+" = :"+columns[i]+" WHERE "+columns[i]+" = " + str(entryList[0]), {columns[i]: entryList[i]}

You can now have the Variables "curTable", "columns", "entryList" set to whatever you want and dont need a static line for everything The same works with INSERT and the other things too

Edit: (its now 3 hours later, 1 AM and i got the safer way)

NOW THAT YOU GOT THAT READ THIS you will be vulnerable to SQL Injection, and you need to still change that code to this:

query = " UPDATE "+curTable+" SET "+columns[i]+" = ? WHERE "+columns[0]+" = ?"
        c.execute(query, (entryList[i], entryList[0], ))

this makes it safer, but as i am not a pro yet maybe someone can confirm

Edit: Removed triple-quotes as they are only needed in multiple-sentence sql stuff thanks for the hint @Tim Roberts