@@ -20,16 +20,17 @@ PostgreSQL or Oracle.
20
20
The sqlite3 module was written by Gerhard Häring. It provides a SQL interface
21
21
compliant with the DB-API 2.0 specification described by :pep: `249 `.
22
22
23
- To use the module, you must first create a :class: `Connection ` object that
23
+ To use the module, start by creating a :class: `Connection ` object that
24
24
represents the database. Here the data will be stored in the
25
25
:file: `example.db ` file::
26
26
27
27
import sqlite3
28
28
con = sqlite3.connect('example.db')
29
29
30
- You can also supply the special name ``:memory: `` to create a database in RAM.
30
+ The special path name ``:memory: `` can be provided to create a temporary
31
+ database in RAM.
31
32
32
- Once you have a :class: `Connection `, you can create a :class: `Cursor ` object
33
+ Once a :class: `Connection ` has been established, create a :class: `Cursor ` object
33
34
and call its :meth: `~Cursor.execute ` method to perform SQL commands::
34
35
35
36
cur = con.cursor()
@@ -48,16 +49,17 @@ and call its :meth:`~Cursor.execute` method to perform SQL commands::
48
49
# Just be sure any changes have been committed or they will be lost.
49
50
con.close()
50
51
51
- The data you've saved is persistent and is available in subsequent sessions::
52
+ The saved data is persistent: it can be reloaded in a subsequent session even
53
+ after restarting the Python interpreter::
52
54
53
55
import sqlite3
54
56
con = sqlite3.connect('example.db')
55
57
cur = con.cursor()
56
58
57
- To retrieve data after executing a SELECT statement, you can either treat the
58
- cursor as an :term: `iterator `, call the cursor's :meth: `~Cursor.fetchone ` method to
59
- retrieve a single matching row, or call :meth: `~Cursor.fetchall ` to get a list of the
60
- matching rows.
59
+ To retrieve data after executing a SELECT statement, either treat the cursor as
60
+ an :term: `iterator `, call the cursor's :meth: `~Cursor.fetchone ` method to
61
+ retrieve a single matching row, or call :meth: `~Cursor.fetchall ` to get a list
62
+ of the matching rows.
61
63
62
64
This example uses the iterator form::
63
65
@@ -72,27 +74,27 @@ This example uses the iterator form::
72
74
73
75
.. _sqlite3-placeholders :
74
76
75
- Usually your SQL operations will need to use values from Python variables. You
76
- shouldn't assemble your query using Python's string operations because doing so
77
- is insecure; it makes your program vulnerable to an SQL injection attack
78
- (see the `xkcd webcomic <https://xkcd.com/327/ >`_ for a humorous example of
79
- what can go wrong)::
77
+ SQL operations usually need to use values from Python variables. However,
78
+ beware of using Python's string operations to assemble queries, as they
79
+ are vulnerable to SQL injection attacks (see the `xkcd webcomic
80
+ <https://xkcd.com/327/> `_ for a humorous example of what can go wrong)::
80
81
81
82
# Never do this -- insecure!
82
83
symbol = 'RHAT'
83
84
cur.execute("SELECT * FROM stocks WHERE symbol = '%s'" % symbol)
84
85
85
- Instead, use the DB-API's parameter substitution. Put a placeholder wherever
86
- you want to use a value, and then provide a tuple of values as the second
87
- argument to the cursor's :meth: `~Cursor.execute ` method. An SQL statement may
86
+ Instead, use the DB-API's parameter substitution. To insert a variable into a
87
+ query string, use a placeholder in the string, and substitute the actual values
88
+ into the query by providing them as a :class: `tuple ` of values to the second
89
+ argument of the cursor's :meth: `~Cursor.execute ` method. An SQL statement may
88
90
use one of two kinds of placeholders: question marks (qmark style) or named
89
91
placeholders (named style). For the qmark style, ``parameters `` must be a
90
92
:term: `sequence <sequence> `. For the named style, it can be either a
91
93
:term: `sequence <sequence> ` or :class: `dict ` instance. The length of the
92
94
:term: `sequence <sequence> ` must match the number of placeholders, or a
93
95
:exc: `ProgrammingError ` is raised. If a :class: `dict ` is given, it must contain
94
- keys for all named parameters. Any extra items are ignored. Here's an example
95
- of both styles:
96
+ keys for all named parameters. Any extra items are ignored. Here's an example of
97
+ both styles:
96
98
97
99
.. literalinclude :: ../includes/sqlite3/execute_1.py
98
100
0 commit comments