Python · SQLite & XML

You build an INSERT query by interpolating user input directly: ``` name = user_input sql = ("INSERT INTO suppliers " "VALUES ('%s')" % name) cur.execute(sql) ``` Why is this dangerous, and what's the fix?

Answer locked. Get the free KnowCard app to reveal it — plus spaced-repetition review so it actually sticks.

This is one card from the KnowCard library — thousands more across SAP, Linux, Python and more. In the app you get the answer, AI explanations, and cards that come back right before you would forget them. Free to start on iOS, Android or the web.

More in SQLite & XML

You INSERT a row, then your program exits cleanly. Next run, the row is gone. ``` con = sqlite3.connect("w.db") cur = con.cursor() cur.execute("INSERT INTO t VALUES (1)") con.close() ``` What did you forget?

What's the difference between passing ":memory:" and a filename to sqlite3.connect()?

What does cursor.fetchall() return when a SELECT matches zero rows?

What does cursor.fetchone() return after the last row has already been read?

When should you reach for fetchmany/fetchone/iterating the cursor instead of fetchall()?

You want to insert many rows. Is this the best tool? ``` for row in rows: cur.execute( "INSERT INTO t VALUES (?,?)", row) ```

Start learning today

Free to start — download the app or use it in your browser.