在 Python SQL 查询中使用 IN 表达式传递 SQL 变量

Question

在 Python 中传递 SQL 查询的最佳做法是使用 (?) 占位符。我遇到了一个问题，我的 SQL 查询有一个 IN 表达式，并且无法确定如何将变量参数传递给占位符。 编辑：这与其他答案不同（如 cmets 中指出的那样），其他答案不包括拆包。我的工作代码是：

cursor = conn.cursor()
query = "Select touchtonekey, COUNT(touchtonekey) as touchedthismanytimes from vw_callhandlertraffic\
            where callhandlername = ? and createddatetime between ?\
            and ? and touchtonekey IN ('1','2') Group By touchtonekey Order by touchtonekey"

data = cursor.execute(query,'My CallHandler','2019-10-09 13:00:00',
                      '2019-12-09 13:59:59')

但是当我尝试使用此代码删除 IN 参数时：

query = "Select touchtonekey, COUNT(touchtonekey) as touchedthismanytimes from vw_callhandlertraffic\
            where callhandlername = ? and createddatetime between ?\
            and ? and touchtonekey IN ? Group By touchtonekey Order by touchtonekey"

data = cursor.execute(query,'My CallHandler','2019-10-09 13:00:00',
                      '2019-12-09 13:59:59', "('1','2')")

我明白了：

Right hand side of IN expression must be a COLLECTION type.

如果我从括号中删除引号，我会得到：

Invalid application buffer type. (-11116) (SQLBindParameter)

Answer 1

这几乎是 python list in sql query as parameter 的骗子，但缺少一些东西：

1. 您还有其他参数，而不仅仅是您的 IN 子句，因此您需要进行一些解包
2. 关于某些 SQL 方言（例如 SQLite）对number of parameters you can pass 有限制的说明。

更正的代码：

cursor = conn.cursor()

membership_data = [1, 2] 
placeholders = ', '.join(['?' for item in membership_data])

query = """
        SELECT touchtonekey, COUNT(touchtonekey) AS touchedthismanytimes 
        FROM vw_callhandlertraffic
        WHERE callhandlername = ? AND createddatetime BETWEEN ? AND ? 
            AND touchtonekey IN ({}) 
        GROUP BY touchtonekey 
        ORDER BY touchtonekey
        """.format(placeholders) # Add the placeholders to your IN clause

data = cursor.execute(query,
                      ('My CallHandler',
                      '2019-10-09 13:00:00',
                      '2019-12-09 13:59:59',
                      *membership_data)) # Unpack the list

注意使用*、the "splat"/"unpacking" operator 来为execute 制作一个扁平的参数元组

Answer 2

当我输入我的问题时，我想通了。由于我没有在 Stack Overflow 上看到答案（我可能只是找不到答案），我想我会发布这个问题然后回答它，以防它帮助其他人。关键是始终使用 = ?语法，然后在参数中包含 IN 关键字，如下所示：

cursor = conn.cursor()

    query = "Select touchtonekey, COUNT(touchtonekey) as 
             touchedthismanytimes from vw_callhandlertraffic\
             where callhandlername = ? and createddatetime between ?\
             and ? and touchtonekey = ? Group By touchtonekey Order by\ 
             touchtonekey"

    data = cursor.execute(query,'My CallHandler','2019-10-09 13:00:00',
                                 '2019-12-09 13:59:59',"IN ('1','2')")