Elegent solution to replacing ' and " ?

[fyleow]

I'm trying to replace the ' and " characters in the strings I get from
feedparser so I can enter it in the database without getting errors.
Here's what I have right now.

self.title = entry.title.enc ode('utf-8')
self.title = self.title.repl ace('\"', '\\\"')
self.title = self.title.repl ace('\'', '\\\'')

This works just great but is there a more elegent way to do this? It
looks like maybe I could use the translate method but I'm not sure.

[Jim]

Re: Elegent solution to replacing ' and " ?

Are you sure that your dB interface module doesn't do this for you?
What dB and interface are you using?

Jim

[Serge Orlov]

Re: Elegent solution to replacing ' and " ?

fyleow wrote:[color=blue]
> I'm trying to replace the ' and " characters in the strings I get from
> feedparser so I can enter it in the database without getting errors.
> Here's what I have right now.
>
> self.title = entry.title.enc ode('utf-8')
> self.title = self.title.repl ace('\"', '\\\"')
> self.title = self.title.repl ace('\'', '\\\'')
>
> This works just great but is there a more elegent way to do this? It
> looks like maybe I could use the translate method but I'm not sure.[/color]

You should use execute method to construct sql statements. This is
wrong:

self.title = entry.title.enc ode('utf-8')
self.title = self.title.repl ace('\"', '\\\"')
self.title = self.title.repl ace('\'', '\\\'')
cursor.execute( 'select foo from bar where baz="%s" ' % self.title)

This is right:

self.title = entry.title
cursor.execute( "select foo from bar where baz=%s", (self.title,))

The formatting style differs between db modules, take a look at
paramstyle description in PEP 249:

http://www.python.org/dev/peps/pep-0249/

[fyleow]

Re: Elegent solution to replacing ' and " ?

I'm using PyGreSQL on a PostgreSQL db.

I didn't even include my SQL but Serge guessed right and that's what I
had. I changed it and it works now.

Thanks for the help! :)