Python sqlite3 parameterised query

Code pattern Check Code patterns

Definition

Use ? placeholders and pass values separately, never join user text into the SQL string, to stop SQL injection.

Example

cur.execute("SELECT * FROM user WHERE name = ?", (name,))

Check this one: Parameterised queries are standard secure practice (defensive input handling); the syllabus does not name sqlite3.

Where it is used in the test

Syllabus area: Code patterns.

Question types it can appear in

Python: Write or complete it in the online Python tool.
Code reading: Code or algorithm reading: interpret a fragment and state its output or purpose.
Short answer: Define, outline or explain it and tie it to the scenario.

No past question in this bank is linked to this term yet. It can still be tested through the question types above.

Study links

Flashcard: Python sqlite3 parameterised query in Code Patterns: Pseudocode, Python, SQL, CSS (Years 11 and 12) · study that set
Memorise: Python basics: input, selection, loops, strings

How to use it in an answer

A model sentence

General advice, built from the definition and example above

Code pattern: “Use ?” Then apply it: cur.execute("SELECT * FROM user WHERE name = ?", (name,))

In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.

Command words used with it

General advice

No linked question shows the command word for this term. Across the past python and short answer questions in this bank the words used most are: Explain, Outline, Describe, Compare, Classify, Analyse. Check the actual word in your question.

Technique for the question types

Python: Write code that runs: indentation, quotes, define functions before calling them, print the required output, meet every listed requirement.
Short answer: One clear point per mark, use the stimulus and course terms, and answer the command word.

Common mistakes

Marker feedback on other questions of the same type (code and diagram feedback often applies across questions)

Check the sources: Parameterised queries are standard secure practice (defensive input handling); the syllabus does not name sqlite3.
Python questions (2025 HSC exam Q19): process string inputs; use a selection structure; code must execute in the environment; use correct indentation; call functions in the main program after defining them.
Python questions (2025 HSC exam Q26): replicate the grid; use the random library; use selection and looping to access the list; include a method of checking the number of values; use meaningful variable names and constants; avoid overly complex structures such as nested IF loops.