Update images in SQL from Python - python

I have an issue trying to upload files from Python to my database. I can insert the binary data into the table just fine using %s, but when I try to update the record, I am unable to get this to work. Am I doing something wrong?
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x01\x90\x00\x00\x00\xc8\x08\x06\x00\' at line 8
Now, I know this is because the bytestring contains a ' so this doesn't work, it excepts, and leaves some security holes open if it were to work:
dbc.execute(f"""UPDATE userdata SET
emailaddr ='{email}',
firstname ='{namee}',
lastname ='{laste}',
username ='{usere}',
password ='{passe}',
phonenum ='{phone}',
photoimg ='{u_pho}'
WHERE user_id = '{user_ident}';""")
but I'm wondering if I can update a value like this:
insertcommand = f"""UPDATE userdata SET (emailaddr,firstname,lastname,username,password,phonenum,photoimg) VALUES (%s, %s, %s, %s, %s, %s, %s) WHERE user_id = '{user_ident}'"""
insertrecord = email,namee,laste,usere,passe,phone,u_pho
dbc.execute(insertcommand,insertrecord)
How would I go about updating bytestrings in MySQL with Python?

Related

Insert data in oracle database in python

I can't insert data into database using a dynamic query in python script
def execute_query(self, qo):
query_string = "INSERT INTO " +dep_table+ " (client, sis, entity_name_1, entity_name_2, flag_dep,process, flag_dep_det) VALUES (%s, %s, %s, %s, %s, %s, %s)" % ("'CO'","'"+qo.db_src+"'","'"+qo.table_src+"'","'"+qo.table_des+"'","'"+qo.check_func+"'","'"+qo.table_des+"'","'NULL'")+";"
cursor.execute(query_string)
I got this error:
ERROR: Failed to set dependencies informations : ORA-00933: SQL command not properly ended
The connection to the database is okay, but I can't insert.
Drop the semi-colon at the end of the string you are creating / executing.
It shouldn't be part of the SQL statement, rather used in some client tools to indicate the end of a statement so that the client can send it to the database to be executed.
I found the solution to the problem
connection.commit()
You can use format method in Python like below:
def execute_query(self, qo):
query_string = "INSERT INTO {0} (client, sis, entity_name_1, entity_name_2, flag_dep,process, flag_dep_det) VALUES ('{1}', '{2}', '{3}', '{4}', '{5}', '{6}', {7})".format(dep_table, 'CO', qo.db_src, qo.table_src, qo.table_des, qo.check_func, qo.table_des, 'NULL')
cursor.execute(query_string)

Python MySQL INSERT throws ProgrammingError: 1064

First-time question. I am writing a Python application for personal use, which reads metadata from MP3 files I've collected on CD-ROMs and inserts it into a MySQL database. At least, it should--but when it comes to the actual INSERT statement, the program is throwing a ProgrammingError: "1064: You have an error in your SQL syntax," etc.
In trying to write this program, I've learned how to create parameterized queries, instantiate the cursor object with cursor_class = MySQLCursorPrepared, and instantiate the database connection with use_pure = True. I've searched the Web for similar problems but come up dry.
Here is the offending code (it's the cursor.execute line specifically that throws the exception; for debugging purposes I've temporarily removed the try/except blocks):
table = "mp3_t"
# Parameterized query for SQL INSERT statement
query = '''
INSERT INTO %s
(track_num, title, artist, album, album_year, genre, discname)
VALUES
(%s, '%s', '%s', '%s', %s, '%s', '%s')
'''
conn = self.opendb(self.config)
cursor = conn.cursor(cursor_class = MySQLCursorPrepared)
for track in tracklist:
print("Counter: {}".format(counter))
# Tuple for parameterized query
input = (table, track['track_num'], track['title'],
track['artist'], track['album'], track['album_year'],
track['genre'], track['discname'])
print(query % input) # What is the actual query?
cursor.execute(query, input)
The database table is defined with the following SQL:
CREATE TABLE mp3_t (
id int NOT NULL PRIMARY KEY AUTO_INCREMENT,
track_num int NOT NULL,
title VARCHAR(255) NOT NULL,
artist VARCHAR(255) NOT NULL,
album VARCHAR(255) NOT NULL,
album_year int NOT NULL,
genre VARCHAR(255) NOT NULL,
discname VARCHAR(255) NOT NULL);
For debugging, I've got a print statement that outputs the query that's being sent to MySQL (the error message is particularly unhelpful for trying to pinpoint the cause of the problem), for example:
INSERT INTO mp3_t
(track_num, title, artist, album, album_year, genre, discname)
VALUES
(1, 'Moribund the Burgermeister', 'Peter Gabriel', 'I', 1977, 'Rock', 'Rock 19')
I don't see any error visually, and if I paste directly into the MySQL CLI and add the required semicolon, it inserts a row into the table as expected.
I'm completely stymied where the problem lies.
If it's any help, I'm running Python 3.6.7 and MariaDB 10.1.37 with Connector/Python 8.0.15, on Ubuntu 18.04 64-bit.
Table name should not be replaced by %s. I think your error message should like:
You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near "mp3_t"
So just use table name in your query template.
INSERT INTO mp3_t
(track_num, title, artist, album, album_year, genre, discname)
VALUES
(%s, %s, %s, %s, %s, %s, %s)
If you want to know the query will be executed, you should use these codes:
conn = connect()
cur = conn.cursor()
print(query % cur._get_db().literal(params))
Don't use %s for table name. Use the table name directly.

Can't get the right SQL syntax using pymsql, error 1064

My output works in csv, but not when trying to insert it into mysql. I get the following error and have not been able to figure it out. I'm a novice so I may be missing something obvious. Same error in Python 2x and 3x.
pymysql.err.ProgrammingError: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'key, title, content, start_date, end_date, initial_update) VALUES('reddit', 'h' at line 1")
mainDB_cnx = pymysql.connect(user='XXXX', password='XXXX',
host='XXXX',
database='Test', use_unicode=True, charset="utf8mb4")
with mainDB_cnx:
mainDB_cursor = mainDB_cnx.cursor()
mainDB_cursor.execute(
"INSERT INTO reddit(site, site_url, key, title, content, start_date, end_date, initial_update) VALUES(%s, %s, %s, %s, %s, STR_TO_DATE(%s,'%%Y-%%m-%%d'), STR_TO_DATE(%s,'%%Y-%%m-%%d'), STR_TO_DATE(%s,'%%Y-%%m-%%d'))",
(["reddit", "http://www.reddit.com", url, title, content, datetime.strptime(date,'%d %B %Y').strftime('%Y-%m-%d'), datetime.strptime('2018-07-25','%Y-%m-%d').strftime('%Y-%m-%d'), datetime.strptime('2018-07-25','%Y-%m-%d').strftime('%Y-%m-%d')]))
print("Successful")
KEY is a reserved word in the MySQL dialect of structured query language. See this. https://dev.mysql.com/doc/refman/8.0/en/keywords.html#keywords-8-0-detailed-K
So you must wrap that column name in delimiters whenever you mention it.
Try
INSERT INTO reddit (side, site_url, `key`, title, ....
Or, better, don't use reserved words for the names of columns in your tables. The next programmer to work on your system will thank you.

Can't See Data In pgAdmin after using python code

I am trying to take a dataframe and import it into a postgresql database. I've done this before and can always see the data in the database using pgAdmin. However, this time, there's no data visable in pgAdmin.
This is the SQL code I've used to create my table in the postgresql database:
CREATE TABLE Twitterapp
(
tweetid character varying(255),
tweettext character varying(255),
tweetretweetct integer,
tweetfavoritect integer,
tweetsource character varying(255),
tweetcreated character varying(255),
userid character varying(255),
userscreen character varying(255),
username character varying(255),
usercreatedt character varying(255),
user_desc character varying(255),
userfollowerct integer,
userfriendsct integer,
userlocation character varying(255),
usertimezone character varying(255)
)
WITH (
OIDS=FALSE
);
Then, using the sqlalchemy library in python, I tried to push my dataframe to the database:
#First attempt to load data
engine =create_engine('postgresql://username:password#link:5432/db_name')
conn = engine.connect()
a.to_sql('public.twitterapp', con=conn, if_exists='replace',
index=False)
Since that operation was successful, I try to read a table from the database to check sure it worked:
##call data from database
result_set = engine.execute("SELECT * FROM twitterapp")
for r in result_set:
print(r)
This code successfully returns the data in my dataframe but I still can't see it in my pgAdmin database. So I tried this second approach:
b = a.values.tolist()
sql2 = """INSERT INTO twitterapp VALUES(%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s);"""
conn = psycopg2.connect("dbname='db_name' user='username' host='link' password='password'")
c = conn.cursor()
for row in b:
c.execute(sql2, row)
print(row)
conn.commit()
Again, it successfully executes (ie, doesn't throw an error) but no data shows in pgAdmin.
What am I doing wrong?!
If you can show data during the session but not from pgAdmin (a different session) it's sure that your mistake is a wrong commit.
I'm not an expert of sqlalchemy but I think you have to read how to manage the session and how to commit it.
This is a good link:
http://docs.sqlalchemy.org/en/latest/orm/session_basics.html
You have to create a session object and execute a commit command:
session.commit()
You should check the port in psql if it's right or not. In my case local postgresql was listening to port 5433

Python insert into %s MySQL

I am trying to insert some data into a database using the variable test as the table name. But unfortunately I cant seem to achieve this. Can anyone help me out?
From my raise I am getting:
TypeError: unsupported operand type(s) for %: 'tuple' and 'tuple'
My code:
test = "hello"
# Open database connection
db = MySQLdb.connect("127.0.0.1","admin","password","table" )
# prepare a cursor object using cursor() method
cursor = db.cursor()
# Prepare SQL query to INSERT a record into the database.
sql = ("""INSERT INTO %s (name,
age, gender)
VALUES (%s, %s, %s)""",(test))
try:
# Execute the SQL command
cursor.execute(sql, (name, age, gender))
db.commit()
except:
raise
db.rollback()
# disconnect from server
db.close()
I don't think MySQLdb lets you use parameters for table names -- usually this is used for actual parameters (ones that are sometimes from user input and need sanitization - the name/age/gender part gets this right). You could use Python's string formats to achieve this:
sql = ("""INSERT INTO {table} (name, age, gender)
VALUES (%s, %s, %s)""".format(table=table), (test))
Something like this will work:
sql = """INSERT INTO %s (name, age, gender)
VALUES (%s, %s, %s)""" % (test, "%s", "%s", "%s")
You need to separate Python's string substitution from MySQL's parameter substitution. The above is a crude approach, but minimally different from your own code.

Categories