在python中将单引号替换为双引号，以便与插入数据库一起使用

Question

Was wondering whether anyone has a clever solution for fixing bad insert statements in Python, exported by a not so clever program. It didn't add two single quotes for strings with a single quote in the string. To make it a bit easier all the values being inserted are strings.

So it has:

INSERT INTO addresses VALUES ('1','1','CUCKOO'S NEST','CUCKOO'S NEST STREET');

instead of:

INSERT INTO addresses VALUES ('1','1','CUCKOO''S NEST','CUCKOO''S NEST STREET');

Obviously there are multiple lines of this and I don't want to replace the enclosing single quotes as well.

Was thinking of using split and join, but I'm not sure how to easily update the split values while looping in a loop. Sorry I'm a noob. Something like the below, where I'm not sure how to do #update bit

import sys

fileIN = open('a.sql', "r")
line = fileIN.readline()

while line:
   bits = line.split("','")
   for bit in bits:
      if bit.find("'") > -1:
         #update bit
   line_out = "','".join(bits)      
   sys.stdout.write(line_out)
   line = fileIN.readline()

Thanks

Answer 1

Based on katrielalex's suggestion, how about this:

>>> import re
>>> s = "INSERT INTO addresses VALUES ('1','1','CUCKOO'S NEST','CUCKOO'S NEST STREET');"
>>> def repl(m):
    if m.group(1) in ('(', ',') or m.group(2) in (',', ')'):
        return m.group(0)
    return m.group(1) + "''" + m.group(2)

>>> re.sub("(.)'(.)", repl, s)
"INSERT INTO addresses VALUES ('1','1','CUCKOO''S NEST','CUCKOO''S NEST STREET');"

and if you're into negative lookbehind assertions, this is the headache inducing pure regex version:

re.sub("((?<![(,])'(?![,)]))", "''", s)

Answer 2

while line:
    # Restrain line2 to inside parentheses
    line1, rest = line.split('(')
    line2, line3 = rest.split(')')
    # A bit more cleaner
    new_bits = []
    for bit in line2.split(','):
        # Remove border ' characters
        bit = bit[1:-1]
        # Duplicate the ones inside
        if "'" in bit:
            bit = bit.replace("'", "''")
        # Re-add border '
        new_bits.append("'" + bit + "'")
   sys.stdout.write(line1 + '(' + ','.join(new_bits + ')' + line3)
   line = fileIN.readline()

Answer 3

Warning: This depends way too much on the formatting of the SQL statement. However, if your input is only ever going to have the format "statements (params) end" then this will work every time.

import sys

fileIN = open('a.sql', "r")
line = fileIN.readline()

while line:
    #split out the parameters (between the ()'s)
    start, temp = line.split("(")
    params, end = temp.split(")")

    #replace the "'"s in the parameters (without the start and end quote)
    newParams = "','".join([x.replace("'", "''") for x in params[1:-1].split("','")])

    #join the statement back together
    line_out = start + "('" + newParams + "')" + end

    #next line
    sys.stdout.write(line_out)
    line = fileIN.readline()

Explanation:

1. Split the string into 3 parts: The query start, the parameters, and the end.
2. The generator takes the parameters (without the starting/ending ' s), splits it on ',' , and, for every element in the list the split generates (the individual data entries), replaces the ' s with '' s.
3. The last line then joins the query start, the new params (with the parenthesis and quotes that were removed previously), and the end of the statement.

Answer 4

Another answer:

a = "INSERT INTO addresses VALUES ('1','1','CUCKOO'S NEST','CUCKOO'S NEST STREET');"
open_par = a.find("(")
close_par = a.find(")")
b = a[open_par+1:close_par]
c = b.split(",")
d = map(lambda x: '"' + x.strip().strip("'") + '"',c)
result = a[:open_par+1] + ",".join(d) + a[close_par:]

Answer 5

Went with:

import sys
import re

def repl(m):
    if m.group(1) in ('(', ',') or m.group(2) in (',', ')'):
        return m.group(0)
    return m.group(1) + "''" + m.group(2)

fileIN = open('a.sql', "r")
line = fileIN.readline()

while line:
    line_out = re.sub("(.)'(.)", repl, line)
    sys.stdout.write(line_out)
    # Next line.
    line = fileIN.readline()