“UPDATE RAN_Plan_activity set Daily_WO = '”+Update_Daily_WO+“', Daily_WO_Creation_Date&Time = '”+Update_Daily_WO_Creation_DateTime+“’ Where Site ID='”+Site_ID+“’ and PMR Planned Date ='”+CurrentDate+“';”
Prepare the SQL query using parameter substitution
query = “”"
UPDATE RAN_Plan_activity
SET Daily_WO = %s, Daily_WO_Creation_Date&Time = %s
WHERE Site ID = %s AND PMR Planned Date = %s;
“”"
try:
# Create a cursor object
with connection.cursor() as cursor:
# Execute the SQL command
cursor.execute(query, (Update_Daily_WO, Update_Daily_WO_Creation_DateTime, Site_ID, CurrentDate))
# Commit the transaction
connection.commit()
except Exception as e:
print(f"An error occurred: {e}")
finally:
# Close the connection
connection.close()
By using placeholders like %s and passing the values separately, you protect against SQL injection.
Use try...except blocks to catch any errors during execution.
Remember to commit the transaction if the operation involves modifying the database.
Always close the database connection after your operations are complete to free up resources.