2

I have following PostgreSQL query 

cond = {'notified':'100','token':'123','usage':'kart_user'}
sql = "UPDATE {} set notified = %(notified)s where token = %(token)s".format(cond['usage'])
result = self.cur.execute(sql,cond)
result = self.dbconn.commit()
return res

Now, the problem I facing in the case of dynamic dictionary.
dictionary keys and value is not fixed.
Eg-

cond = {'notified':'100','token':'123','custid':'1v123','buyer':'yes','usage':'kart_user'}

How i can rewrite above update query in the case of dynamic keys?
Thank you for your response.

kylieCatt
  • 10,672
  • 5
  • 43
  • 51
Abdul Razak
  • 2,654
  • 2
  • 18
  • 24
  • 1
    Just a quick security tip! NEVER pass your query parameters in with `format()`! That opens you up for SQL injection. See [docs](http://initd.org/psycopg/docs/usage.html#passing-parameters-to-sql-queries) on how to do it properly. – mirosval Dec 16 '15 at 07:17
  • If you want to pass column as parameter, look this http://stackoverflow.com/questions/27289957/pass-column-name-as-parameter-to-postgresql-using-psycopg2 – Kenly Dec 16 '15 at 08:25

0 Answers0