@@ -21,16 +21,17 @@ The sqlite3 module was written by Gerhard Häring. It provides a SQL interface
21
21
compliant with the DB-API 2.0 specification described by :pep: `249 `, and
22
22
requires SQLite 3.7.15 or newer.
23
23
24
- To use the module, you must first create a :class: `Connection ` object that
24
+ To use the module, start by creating a :class: `Connection ` object that
25
25
represents the database. Here the data will be stored in the
26
26
:file: `example.db ` file::
27
27
28
28
import sqlite3
29
29
con = sqlite3.connect('example.db')
30
30
31
- You can also supply the special name ``:memory: `` to create a database in RAM.
31
+ The special path name ``:memory: `` can be provided to create a temporary
32
+ database in RAM.
32
33
33
- Once you have a :class: `Connection `, you can create a :class: `Cursor ` object
34
+ Once a :class: `Connection ` has been established, create a :class: `Cursor ` object
34
35
and call its :meth: `~Cursor.execute ` method to perform SQL commands::
35
36
36
37
cur = con.cursor()
@@ -49,16 +50,17 @@ and call its :meth:`~Cursor.execute` method to perform SQL commands::
49
50
# Just be sure any changes have been committed or they will be lost.
50
51
con.close()
51
52
52
- The data you've saved is persistent and is available in subsequent sessions::
53
+ The saved data is persistent: it can be reloaded in a subsequent session even
54
+ after restarting the Python interpreter::
53
55
54
56
import sqlite3
55
57
con = sqlite3.connect('example.db')
56
58
cur = con.cursor()
57
59
58
- To retrieve data after executing a SELECT statement, you can either treat the
59
- cursor as an :term: `iterator `, call the cursor's :meth: `~Cursor.fetchone ` method to
60
- retrieve a single matching row, or call :meth: `~Cursor.fetchall ` to get a list of the
61
- matching rows.
60
+ To retrieve data after executing a SELECT statement, either treat the cursor as
61
+ an :term: `iterator `, call the cursor's :meth: `~Cursor.fetchone ` method to
62
+ retrieve a single matching row, or call :meth: `~Cursor.fetchall ` to get a list
63
+ of the matching rows.
62
64
63
65
This example uses the iterator form::
64
66
@@ -73,27 +75,27 @@ This example uses the iterator form::
73
75
74
76
.. _sqlite3-placeholders :
75
77
76
- Usually your SQL operations will need to use values from Python variables. You
77
- shouldn't assemble your query using Python's string operations because doing so
78
- is insecure; it makes your program vulnerable to an SQL injection attack
79
- (see the `xkcd webcomic <https://xkcd.com/327/ >`_ for a humorous example of
80
- what can go wrong)::
78
+ SQL operations usually need to use values from Python variables. However,
79
+ beware of using Python's string operations to assemble queries, as they
80
+ are vulnerable to SQL injection attacks (see the `xkcd webcomic
81
+ <https://xkcd.com/327/> `_ for a humorous example of what can go wrong)::
81
82
82
83
# Never do this -- insecure!
83
84
symbol = 'RHAT'
84
85
cur.execute("SELECT * FROM stocks WHERE symbol = '%s'" % symbol)
85
86
86
- Instead, use the DB-API's parameter substitution. Put a placeholder wherever
87
- you want to use a value, and then provide a tuple of values as the second
88
- argument to the cursor's :meth: `~Cursor.execute ` method. An SQL statement may
87
+ Instead, use the DB-API's parameter substitution. To insert a variable into a
88
+ query string, use a placeholder in the string, and substitute the actual values
89
+ into the query by providing them as a :class: `tuple ` of values to the second
90
+ argument of the cursor's :meth: `~Cursor.execute ` method. An SQL statement may
89
91
use one of two kinds of placeholders: question marks (qmark style) or named
90
92
placeholders (named style). For the qmark style, ``parameters `` must be a
91
93
:term: `sequence <sequence> `. For the named style, it can be either a
92
94
:term: `sequence <sequence> ` or :class: `dict ` instance. The length of the
93
95
:term: `sequence <sequence> ` must match the number of placeholders, or a
94
96
:exc: `ProgrammingError ` is raised. If a :class: `dict ` is given, it must contain
95
- keys for all named parameters. Any extra items are ignored. Here's an example
96
- of both styles:
97
+ keys for all named parameters. Any extra items are ignored. Here's an example of
98
+ both styles:
97
99
98
100
.. literalinclude :: ../includes/sqlite3/execute_1.py
99
101
0 commit comments