Re: [pysqlite] [APSW] "SQLError: cannot rollback - no transaction is active"

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Eric S. Johansson wrote:
> I tend to use
> string substitution when I have a case where I'm generating some SQL because I
> have varying conditions which require very different SQL expressions.  

I still fail to understand why string substitution is easy and using
bindings is hard.  With string substitution you have a format string,
the % operator and then the parameters.  Bindings are the same thing.

You can make it be even less code with a dictionary as bindings since
the same dictionary can be used in all cases.  And if you have local
variables you can dispense with the bindings altogether.  For example:

  # get these from other functions etc
  title="..."
  isbn="..."
  year=2002
  # 3 different possibilities
  if year<2002:
    sql="...."
  elif year<2008:
    sql="...."
  else: # in the future
    sql="...."

  cursor.execute(sql, locals())

> But with
> string substitution, I now have a very small amount of code in four logical
> blocks making it easy for me to visually inspect the code and unit test the code.

Please can you post an example of this code, because there is something
we are missing.

> all I can say is both approaches have unpleasant consequences.

Not using bindings is the most unpleasant - your data can be corrupted
and is open to attack.  It is quite simply the wrong thing to do.
Avoiding bindings for some apparent short term convenience is just
setting yourself up for long term harm.

Roger
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkkw/V8ACgkQmOOfHg372QRf6QCgiwYIv7XHGbl9PBTuFp5vW5Ly
SqIAnifU4rWHgIwRaCsR0pDDcf3SAPuO
=5tQr
-----END PGP SIGNATURE-----