Escaping dynamic sqlite query?
I'm currently building SQL queries depending on input from the user. An example how this is done can be seen here: def generate_conditions(table_name,nameValues): sql = u"" for field in nameValues: sql += u" AND {0}.{1}='{2}'".format(table_name,field,nameValues[field]) return sql search_query = u"SELECT * FROM Enheter e LEFT OUTER JOIN Handelser h ON e.Id == h.Enhet WHERE 1=1" if "Enhet" in args: search_query += generate_conditions("e",args["Enhet"]) c.execute(search_query) Since the SQL changes every time I cannot insert the values in the execute call which means that I should escape the