Re: [pysqlite] database locked

Dennis Lee Bieber wrote:
> On Fri, 06 Feb 2009 00:24:01 -0500, "Eric S. Johansson"
> <[email protected]> declaimed the following in
> gmane.comp.python.db.pysqlite.user:
> 
> 
>>            selection_command = selection_command +  " limit ?"
> 	<snip>
>> pysqlite2.dbapi2.OperationalError: near "?": syntax error
>>
> 
> 	I suspect you need to fill in the limit using regular % string
> interpolation.

it doesn't bark at me for limit but does bark at me for ? substitution for the
table name.  this is in part why I asked is there anything I can use to see the
end result of the ? substitution process.

> 	Visualize, just for example, a statement like:
> 
> select * from ? where ? = ?
>
...
> 	On the other side of the equation, you are putting quotes around the
> ?s for real data values... You don't need the quotes! Again, the purpose
> of parameterized queries is that the database interface, itself, ensures
> that the contents which take the place of the ? will be properly quoted
> and escaped to fill the role of "data item".

I think I understand.  Maybe what I need to use is a limited set of values and
types to protect against SQL injection attacks. i.e. limit and offset are only
integers and order by argument would be limited to a finite number of possible
that I use.  Then I could use string substitution and get the quoting right
without worrying about injection attacks.