0

I am writing a python module for an Django-based application that accesses an Oracle database via cx_Oracle. It "appears" that the django code has a bug that breaks the use of the cx_Oracle "executemany" method. If I use cx_Oracle with a connection opened strictly via cx_Oracle, the logic works fine. Use a connection via django, it fails.

As django is a requirement, I am looking for a work-around and need to understand what the statement (below) where it fails is trying to do. I understand that "%" is used both as a modulo operator and for string formatting as it apparently is in this case. But despite much searching, this doesn't seem to conform to any string formatting syntax using "%" that I can find. Can someone explain what this is trying to do?

query = query % tuple(args)

TypeError: not all arguments converted during string formatting

Where:

query = 'INSERT INTO DATABASE.TABLE\n        (DATE, ID, COL_A, COL_B, COL_C)\n    VALUES (:1, :2, :3, :4, :5)\n'

args = [':arg0', ':arg1', ':arg2', ':arg3', ':arg4']

If you type these values and the above statement into the REPL, you will get this same error.

I know I should submit a django bug report. Will figure that out later. For now I'm hoping I can somehow change the Oracle bind-variable positional notation in the query string to satisfy the above statement. Again, the query string has no problem working directly with cx_Oracle.

Details:

Python 3.6.5 :: Anaconda, Inc.

cx-Oracle 7.0.0

Django 2.0.7

cx_Oracle query format: https://www.oracle.com/technetwork/articles/dsl/prez-python-queries-101587.html (See "Many at Once")

My cx_Oracle code:

cursor = conn.cursor()
cursor.prepare(query)
cursor.executemany(query, list_of_tuples_of_values)
rows_affected = cursor.rowcount
conn.commit()

The code that's failing is in django module base.py, line 494: (C:\python\Anaconda2\envs\py36\lib\site-packages\django\db\backends\oracle\base.py)

def _fix_for_params(self, query, params, unify_by_values=False):
    # cx_Oracle wants no trailing ';' for SQL statements.  For PL/SQL, it
    # it does want a trailing ';' but not a trailing '/'.  However, these
    # characters must be included in the original query in case the query
    # is being passed to SQL*Plus.
    if query.endswith(';') or query.endswith('/'):
        query = query[:-1]
    if params is None:
        params = []
    elif hasattr(params, 'keys'):
        # Handle params as dict
        args = {k: ":%s" % k for k in params}
        query = query % args
    elif unify_by_values and len(params) > 0:
        # Handle params as a dict with unified query parameters by their
        # values. It can be used only in single query execute() because
        # executemany() shares the formatted query with each of the params
        # list. e.g. for input params = [0.75, 2, 0.75, 'sth', 0.75]
        # params_dict = {0.75: ':arg0', 2: ':arg1', 'sth': ':arg2'}
        # args = [':arg0', ':arg1', ':arg0', ':arg2', ':arg0']
        # params = {':arg0': 0.75, ':arg1': 2, ':arg2': 'sth'}
        params_dict = {param: ':arg%d' % i for i, param in enumerate(set(params))}
        args = [params_dict[param] for param in params]
        params = {value: key for key, value in params_dict.items()}
        query = query % tuple(args)
    else:
        # Handle params as sequence
        args = [(':arg%d' % i) for i in range(len(params))]
        query = query % tuple(args)             <==============
    return query, self._format_params(params)

params = (datetime.datetime(2018, 10, 12, 0, 0), '123456', 10, 10, 8)
blhsing
  • 91,368
  • 6
  • 71
  • 106
  • Never ever use string formatting (f-strings, `str.format()` or `%`) on SQL queries. You will get SQL injection vulnerabilities this way. – Klaus D. Oct 23 '18 at 05:30

2 Answers2

1

To enable cross-database compatibility, Django uses uniform placeholders across all database backends. The code you pasted translates %s placeholders to Oracle-specific placeholders, but it fails because your query is already using Oracle-specific placeholders.

Replace the placeholders with %s and it should work:

 query = 'INSERT INTO DATABASE.TABLE\n        (DATE, ID, COL_A, COL_B, COL_C)\n    VALUES (%s, %s, %s, %s, %s)\n'
knbk
  • 52,111
  • 9
  • 124
  • 122
0

% is the string formatting operator, which applies item values in the tuple that follows to the placeholders (that start with a %) in the formatting string that precedes it.

Since your query string does not actually contain any formatting placeholders that start with a %, the % operator fails because it can't map the values in the tuple to placeholders when there isn't any placeholder. For your purpose you should pass args as a parameter to the execute method of your database cursor, so that the argument values can be applied to the bind variables (denoted by :1, :2, etc. in the query string) in a secure manner.

blhsing
  • 91,368
  • 6
  • 71
  • 106