MySQL INSERT Problem

[gw1500se]

I am trying to insert a row into a table with this code:

query="INSERT INTO Members VALUE ('"+args["first"].value+"','"+args["last"].value+"','"+mac+\
     "','"+args["email"].value+"',false,'','');"
try:
     rows=cur.execute(query)
     print("Success - ",rows)
except (MySQLdb.Error,MySQLdb.Warning) as e:
     print("Error:  [%d] - %s" % (e.args[0], e.args[1]))

I am getting the "Success" output with 1 row. However, when I manually do a "select * from Members" the empty set is returned. Obviously in spite of the row count being 1, nothing was added to the table. I have no clue how to debug this since it looks like a success from Python. Can someone explain how this is possible or how to debug it? TIA.

[buran]

do you execute connection commit() after the insert?

https://dev.mysql.com/doc/connector-pyth...ction.html

Since by default Connector/Python turns autocommit off, and MySQL 5.5 and higher uses transactional InnoDB tables by default, it is necessary to commit your changes using the connection's commit() method.

Note also how to properly construct the INSERT statement

[gw1500se]

Thanks. I sure missed that one. It is working now. However, as far as your comment about constructing an insert, it sure looks right to me and it works. What are you seeing that I am not?

[buran]

you should use parameterized statements in order to prevent sql injections.

you may also take advantage of using prepared statements (https://dev.mysql.com/doc/connector-pyth...pared.html)

[gw1500se]

Prepared statements is my normal practice (old PHP programmer). However, everything I searched indicated there was no prepared statements in python mysql and were unnecessary. Based on your comment I now see why the threads I found, indicating prepared statements do not exist in python, inexplicably switched the topic to parameterized queries. Odd that no one mentioned your link before. Thanks again.

[buran]

well, I also posted a link to prepared statements in python too :-)