Fetching data from Microsoft Access database using SELECT QUERY WITH WHERE CLAUSE in python
<pre><code>from tkinter import *

lg = Tk()
lg.state('zoomed')

def view():
   cus = accno.get()
   dis = [cus]
   print(dis)
   import pypyodbc
   con=pypyodbc.win_connect_mdb("D:\\customer_details.mdb")
   cur = con.cursor()

   q = "select * from cus_details where cus_id = '" + cus + "' "
   cur.execute(q,dis)
   result=cur.fetchall()
   Label(lg,text="",font = "Calibri 12 bold",width=2).grid(row=1,column=1)
   Label(lg,text="",font = "Calibri 12",width=2).grid(row=2,column=1)
   Label(lg,text="",font = "Calibri 12",width=2).grid(row=3,column=1)
   Label(lg,text="",font = "Calibri 12",width=2).grid(row=4,column=1)
   Label(lg,text="",font = "Calibri 12",width=2).grid(row=5,column=1)
   Label(lg,text="",font = "Calibri 12",width=2).grid(row=6,column=1)
   Label(lg,text="",font = "Calibri 12",width=2).grid(row=7,column=1)
   Label(lg,text="",font = "Calibri 12",width=10).grid(row=8,column=0)
   Label(lg,text="",font = "Calibri 12",width=10).grid(row=9,column=1)
   Label(lg,text="",font = "Calibri 12",width=10).grid(row=9,column=2)

   Label(lg,text="Customer ID",font = "Calibri 12",width=5).grid(row=9,column=3)
   Label(lg,text="First Name",font = "Calibri 12",width=20).grid(row=9,column=4)
   Label(lg,text="Last Name",font = "Calibri 12",width=15).grid(row=9,column=5)
   Label(lg,text="Address",font = "Calibri 12",width=10).grid(row=9,column=6)
   Label(lg,text="ID Proof",font = "Calibri 12",width=15).grid(row=9,column=7)
   Label(lg,text="A/c No",font = "Calibri 12",width=15).grid(row=9,column=8)
   Label(lg,text="A/c Type",font = "Calibri 12",width=15).grid(row=9,column=9)
   Label(lg,text="Initial Deposit",font = "Calibri                          `                                                     `                    `12",width=15).grid(row=9,column=10)
   r=10
   for row in result:
        Label(lg,text="",font = "Calibri 12",width=10).grid(row=r,column=0)
        Label(lg,text="",font = "Calibri 12",width=10).grid(row=r,column=2)

        Label(lg,text=row[0],font = "Calibri 12",width=5).grid(row=r,column=3)
        Label(lg,text=row[1],font = "Calibri 12",width=10).grid(row=r,column=4)
        Label(lg,text=row[2],font = "Calibri 12",width=20).grid(row=r,column=5)
        Label(lg,text=row[3],font = "Calibri 12",width=10).grid(row=r,column=6)
        Label(lg,text=row[4],font = "Calibri 12",width=10).grid(row=r,column=7)
        Label(lg,text=row[5],font = "Calibri 12",width=10).grid(row=r,column=8)
        Label(lg,text=row[6],font = "Calibri 12",width=10).grid(row=r,column=9)
        Label(lg,text=row[7],font = "Calibri 12",width=10).grid(row=r,column=10)
        r=r+1
   con.close()


     tit = Label(lg,text="BANK MANAGEMENT SYSTEM",font = "Batang 29                  ``   bold",fg = "blue")

` `  tit1 = Label(lg,text="Account Detail",font = "Calibri 15 bold")

``   la1 = Label(lg,text="Account No",font = "Calibri 12")
``         accno = Entry(lg,width=35)

``   but = Button(lg,text="Delete",bg = "green",width=11,height=1,fg =
 ``    "white",font = "Calibri 10 bold")
``   but1 = Button(lg,text="Cancel",bg = "green",width=11,height=1,fg = 
``        "white",font = "Calibri 10 bold")
``    but2 = Button(lg,text="Verify",bg = "green",width=11,height=1,fg = 
``     "white",font = "Calibri 10 bold",command = view) 
``     tit.place(x=600,y=10)

      tit1.place(x=600,y=70)

      la1.place(x=400,y=150)

      accno.place(x=650,y=150)

      but2.place(x=870,y=145)

      lg.mainloop()
</code></pre>

<p>I get the following error:</p>

<blockquote>
<pre><code>     ['1']
     Exception in Tkinter callback
     Traceback (most recent call last):
  File "C:\Python34\lib\tkinter\__init__.py", line 1533, in __call__
    return self.func(*args)
  File "C:\Python34\pypyodbc-1.3.3\customer_details.py", line 15, in view
    cur.execute(q,dis)
  File "C:\Python34\pypyodbc-1.3.3\pypyodbc.py", line 1470, in execute
    self._BindParams(param_types)
  File "C:\Python34\pypyodbc-1.3.3\pypyodbc.py", line 1263, in
    _BindParams
        raise ProgrammingError('HY000',error_desc)
       pypyodbc.ProgrammingError: ('HY000', 'The SQL contains 0 parameter markers,   ``       but 1 parameters were supplied')
</code></pre>
</blockquote>

<p>I am facing a problem in fetching and displaying the data in a grid.</p>

<p>SQL injection is a serious issue and can ultimately destroy your database. The classic to remember is <a href="https://xkcd.com/327/" rel="nofollow">Bobby Tables</a>. For this reason, it's important to build your queries properly to prevent this; that requires some mechanism to "escape" an input so that it cannot be interpreted as a command in itself. </p>

<p><code>q = "select * from cus_details where cus_id = '" + cus + "' "</code><br></p>

<p>This query does not escape anything, since you simply throw the value of <code>cus</code> into your string. <code>cur.execute(q,dis)</code> then fails because there's no marker to explain where the value of <code>dis</code> is supposed to go.</p>

<p>The way to do this is the use placeholders and bindings. In SQLite3 these are <code>?</code> and in other versions of SQL they are <code>%s</code>. I'm not sure which is expected here. EDIT: From Zev Spitz comment, it seems that it's <code>?</code> for placeholder in <a href="https://code.google.com/archive/p/pyodbc/wikis/GettingStarted.wiki" rel="nofollow">this particular case</a> (see <strong>Parameters</strong> section).</p>

<p>Therefore, your query would look something like the following:</p>

<pre><code>q = "SELECT * FROM cus_details WHERE cus_id = ?"
cur.execute(q, (cus,))

# Or

q = "SELECT * FROM cus_details WHERE cus_id = %s"
cur.execute(q, (cus,))
</code></pre>

python ms-access select