Agfdhyk

I'm using pyodbc to query to an SQL Server database

import datetime

import pyodbc    

conn = pyodbc.connect("Driver={SQL Server};Server='dbserver',Database='db',

                       TrustedConnection=Yes")

cursor = conn.cursor()

ratings = ("PG-13", "PG", "G")

st_dt = datetime(2010, 1, 1)

end_dt = datetime(2010, 12, 31)

cursor.execute("""Select title, director, producer From movies 

                Where rating In ? And release_dt Between ? And ?""", 

                ratings, str(st_dt), str(end_dt))

but am receiving the error below. Does the tuple parameter need to be handled in a different way? Is there a better way to structure this query?

('42000', "[42000] [Microsoft][ODBC SQL Server Driver][SQL Server]Line 9: 

  Incorrect syntax near '@P1'. (170) (SQLExecDirectW); 

  [42000] [Microsoft][ODBC SQL Server Driver][SQL Server]

  Statement(s) could not be prepared. (8180)")

UPDATE:

I was able to get this query to work using the string formatting operator, which isn't ideal as it introduces security concerns.

import datetime

import pyodbc    

conn = pyodbc.connect("Driver={SQL Server};Server='dbserver',Database='db',

                       TrustedConnection=Yes")

cursor = conn.cursor()

ratings = ("PG-13", "PG", "G")

st_dt = datetime(2010, 1, 1)

end_dt = datetime(2010, 12, 31)

cursor.execute("""Select title, director, producer From movies 

                Where rating In %s And release_dt Between '%s' And '%s'""" % 

                (ratings, st_dt, end_dt))

You cannot parameterize multiple values in an IN () clause using a single string parameter. The only way to accomplish that is:

1. String substitution (as you did).




2. Build a parameterized query in the form IN (?, ?, . . ., ?) and then pass in a separate parameter for each place holder. I'm not an expert at Python to ODBC but I imagine that this is particularly easy to do in a language like Python. This is safer because you get the full value of parameterization.

To expand on Larry's second option - dynamically creating a parameterized string, I used the following successfully:

placeholders = ",".join("?" * len(code_list))

sql = "delete from dbo.Results where RESULT_ID = ? AND CODE IN (%s)" % placeholders

params = [result_id]

params.extend(code_list)

cursor.execute(sql, params)

Gives the following SQL with the appropriate parameters:

delete from dbo.Results where RESULT_ID = ? AND CODE IN (?,?,?)

The problem is your tuple. The ODBC connection is expecting a string to construct the query and you are sending a python tuple. And remember that you have to get the string quoting correct. I'm assuming that the number of ratings you will be looking for varies. There is probably a better way, but my pyodbc tends to be simple and straightforward.

Try the following:

import datetime

import pyodbc    

conn = pyodbc.connect("Driver={SQL Server};Server='dbserver',Database='db',

                       TrustedConnection=Yes")



def List2SQLList(items):

    sqllist = "%s" % "","".join(items)

    return sqllist





cursor = conn.cursor()

ratings = ("PG-13", "PG", "G")

st_dt = datetime(2010, 1, 1)

end_dt = datetime(2010, 12, 31)

cursor.execute("""Select title, director, producer From movies 

                Where rating In (?) And release_dt Between ? And ?""", 

                List2SQLList(ratings), str(st_dt), str(end_dt))