Syntax for Duckdb > Python SQL with Parameter\Variable

Question

I am working on a proof of concept, using Python and Duckdb.

I am wanting to use a variable\parameter inside the Duckdb SELECT statement.

For example,

y = 2
dk.query("SELECT * FROM DF WHERE x > y").to_df()

How can y be properly referenced?

I was not able to find any documentation\reference @ web.

y is a scalar value? and afterwards you make it a dataframe? — nbk
– nbk, Commented Dec 10, 2022 at 21:20

nbk · Accepted Answer · 2023-03-26 17:07:20Z

6

Your query looks suspicious to me; you always should use a prepared statement to pass variables to the database. It will prevent sql injection and so increase security:

y = 2
con.execute("SELECT * FROM DF WHERE x > ?", [y]).df()

edited Mar 26, 2023 at 17:07

answered Dec 10, 2022 at 21:41

nbk

49.6k8 gold badges32 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Kent Culpepper Over a year ago

duckdb.org/2021/05/14/sql-on-pandas.html

Kent Culpepper Over a year ago

stackoverflow combined 2 lines when i submitted...

Kent Culpepper Over a year ago

sammywemmy answered it but don't see how to indicate. thanks!

nbk Over a year ago

it is insecure so try mine

qwr Over a year ago

prepare statements require prepare query syntax? duckdb.org/docs/sql/query_syntax/prepared_statements.html

|

Collectives™ on Stack Overflow

Syntax for Duckdb > Python SQL with Parameter\Variable

1 Answer 1

6 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related