How to surround only string with quotations when joining dictionary values using Python? -

i'm practicing on python , trying create class helps performing database operations, when inserting database here's code :

def insert(self, **kwargs):     self.__query.execute("insert {} ({}) values ({})".format(self.table, ", ".join(kwargs.keys()), ", ".join(str(v) v in kwargs.values())))     self.__db.commit() 

when ran code testing:

mytable.insert(id=3, name="jack", age=23) 

i got error :

sqlite3.operationalerror: no such column: jack

when replaced execute command print got :

insert testtbl111 (id, name, age) values (3, jack, 23) 

i guess jack must surrounded quotations.

my question: how surround jack quotation while doing ", ".join(str(v) v in kwargs.values()) ?

you don't want try escape value parameters yourself, instead want build insert query , put placeholders (? works sqlite3) values - like:

query = 'insert {} ({}) values({})'.format(self.table, ', '.join(kwargs), ','.join(['?'] * len(kwargs))) 

then, use second method of execute (either on db object or cursor object) pass in values substituted - these automatically correctly escaped database.

self.__db.execute(query, list(kwargs.values()))