Insert python variable value into SQL table
<p>I have a password system that stores the password for a python program in an SQL table. I want the user to be able to change the password in a tkinter window but I am not sure how to use the value of a python variable as the value for the SQL table. Here is a sample code:</p>

<pre><code>import tkinter
from tkinter import *
import sqlite3

conn = sqlite3.connect('testDataBase')
c = conn.cursor()

c.execute("INSERT INTO info Values('test')")
c.execute("SELECT password FROM info")
password = (c.fetchone()[0])

#Window setup
admin = tkinter.Tk()
admin.minsize(width=800, height = 600)
admin.maxsize(width=800, height = 600)
#GUI
passwordChangeLabel = Label(admin, text="It is recommended to change your password after first login!", font=("Arial", 14))
passwordChangeLabel.pack()

passwordChangeCurrentPasswordLabel = Label(admin, text="Current Password: ", font=("Arial", 11))
passwordChangeCurrentPasswordLabel.place(x=275, y=30)
passwordChangeCurrentPasswordEntry = Entry(admin)
passwordChangeCurrentPasswordEntry.place(x=405, y=32.5)

passwordChangeNewPasswordLabel = Label(admin, text="New Password: ", font=("Arial", 11))
passwordChangeNewPasswordLabel.place(x=295, y=50)
passwordChangeNewPasswordEntry = Entry(admin)
passwordChangeNewPasswordEntry.place(x=405, y=52.5)

passwordChangeButton = Button(admin, text="Submit", width=20)
passwordChangeButton.place(x=350, y=80)

def changePasswordFunction(event):
    newPassword = passwordChangeNewPasswordEntry.get()
    enteredPassword = passwordChangeCurrentPasswordEntry.get()
    if enteredPassword == password:
        c.execute("REPLACE INTO info(password) VALUES(newPassword)")
    else:
        wrong = tkinter.Toplevel()
        wrong.minsize(width=200, height = 100)
        wrong.maxsize(width=200, height = 100)
        Label(wrong, text="Sorry that password is incorrect!", font=("Arial", 24), anchor=W, wraplength=180, fg="red").pack()

admin.bind('&lt;Return&gt;', changePasswordFunction)
passwordChangeButton.bind('&lt;Button-1&gt;', changePasswordFunction)
</code></pre>

<p>This code will bring up an error:</p>

<pre><code>sqlite3.OperationalError: no such column: newPassword
</code></pre>

<p>How can I properly replace the previous value in the password column with the new entered password?</p>

<p>There are two valid ways to use <code>VALUES()</code>: with a label or a string literal.  A string literal is a string in single or double quotes.</p>

<p>Since you didn't put <code>newPassword</code> in quotes, Sqlite assumes <code>newPassword</code> is a label, i.e. a column name.  It goes looking for the value of the <code>newPassword</code> field in the current record, and throws an error since that field doesn't exist.</p>

<p>What you want to do is, take the value of the <code>newPassword</code> python variable and put it in quotes.  Here's a corrected query string (not tested):</p>

<pre><code>"REPLACE INTO info(password) VALUES('" + newPassword + "')"
</code></pre>

<p>As someone mentions in the comments, updating your database directly with user inputs is highly insecure.  Database interfaces generally provide easy ways to sanitize all inputs, and you should make it a point to follow those practices.  A great resource with code examples from many popular languages is <a href="http://bobby-tables.com/" rel="nofollow">Bobby Tables</a>.  (Also note that failing to include information about SQL security in your answers at SO can result in down-votes.)</p>

python sqlite tkinter