TK Study
HomeLearn step by stepMemoriseKey termsFlashcardsNotesMaster answersPast questionsMultiple choiceMock examPractice & marker

Software Engineering › Learn step by step › Python, SQL and pseudocode

Item 419 of 426 · Python, SQL, pseudocode and CSS patterns, 26 of 33

Python sqlite3 parameterised query

Code pattern Check

Jump to a topic
  1. Exam format, question types and command words (46)
  2. Year 11: Programming Fundamentals (69)
  3. Year 11: The Object-Oriented Paradigm (33)
  4. Year 11: Programming Mechatronics (29)
  5. Year 12: Secure Software Architecture (57)
  6. Year 12: Programming for the Web (59)
  7. Year 12: Software Automation (35)
  8. Year 12: The Software Engineering Project (47)
  9. Diagrams and modelling tools (18)
  10. Python, SQL, pseudocode and CSS patterns (33)

See every item in the sequence

Definition

Use ? placeholders and pass values separately, never join user text into the SQL string, to stop SQL injection.

Example

cur.execute("SELECT * FROM user WHERE name = ?", (name,))

Check this one: Parameterised queries are standard secure practice (defensive input handling); the syllabus does not name sqlite3.

Where you'll use it in the test

Syllabus area: Code patterns.

Question types it can appear in

  • Python: Write or complete it in the online Python tool.
  • Code reading: Code or algorithm reading: interpret a fragment and state its output or purpose.
  • Short answer: Define, outline or explain it and tie it to the scenario.

How to use it

A model sentence

General advice, built from the definition and example above

Code pattern: “Use ?” Then apply it: cur.execute("SELECT * FROM user WHERE name = ?", (name,))

In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.

Command words used with it

General advice

No linked question shows the command word for this term. Across the past python and short answer questions in this bank the words used most are: Explain, Outline, Describe, Compare, Classify, Analyse. Check the actual word in your question.

Go deeper

Check yourself

Write or say the “Python sqlite3 parameterised query” pattern from memory: the syntax and what it does.

Reveal the answer

Use ? placeholders and pass values separately, never join user text into the SQL string, to stop SQL injection.

Example: cur.execute("SELECT * FROM user WHERE name = ?", (name,))

Could be tested as: Python, Code reading, Short answer.