Skip to content
Prev Previous commit
Next Next commit
Adjust wording again
  • Loading branch information
Erlend E. Aasland committed Oct 29, 2021
commit 204052c630ae896abf5a4dd2417007a42e83125b
19 changes: 10 additions & 9 deletions Doc/library/sqlite3.rst
Original file line number Diff line number Diff line change
Expand Up @@ -83,15 +83,16 @@ vulnerable to an SQL injection attacks (see the `xkcd webcomic
cur.execute("SELECT * FROM stocks WHERE symbol = '%s'" % symbol)

Instead, use the DB-API's parameter substitution by putting placeholders in the
query string. Provide the values as a :class:`tuple` via the second argument of
the cursor's :meth:`~Cursor.execute` method. An SQL statement may use one of two
kinds of placeholders: question marks (qmark style) or named placeholders (named
style). For the qmark style, ``parameters`` must be a :term:`sequence
<sequence>`. For the named style, it can be either a :term:`sequence <sequence>`
or :class:`dict` instance. The length of the :term:`sequence <sequence>` must
match the number of placeholders, or a :exc:`ProgrammingError` is raised. If a
:class:`dict` is given, it must contain keys for all named parameters. Any extra
items are ignored. Here's an example of both styles:
query string. Provide the actual values as a :class:`tuple` as the second
argument oo the cursor's :meth:`~Cursor.execute` method. An SQL statement may
use one of two kinds of placeholders: question marks (qmark style) or named
placeholders (named style). For the qmark style, ``parameters`` must be a
:term:`sequence <sequence>`. For the named style, it can be either a
:term:`sequence <sequence>` or :class:`dict` instance. The length of the
:term:`sequence <sequence>` must match the number of placeholders, or a
:exc:`ProgrammingError` is raised. If a :class:`dict` is given, it must contain
keys for all named parameters. Any extra items are ignored. Here's an example of
both styles:

.. literalinclude:: ../includes/sqlite3/execute_1.py

Expand Down