mysqldb: error with Select/execute/escape_string
Question: **executing this code on Python 2.7.10 [GCC 5.2.1 20151010] on linux2**

    
    
    import flask
    from MySQLdb import escape_string as thwart
    username="abc"
    
    conn = MySQLdb.connect(host="localhost",user="root", passwd="xxxxxxx", db="pythonprogramming")
    c       = conn.cursor()
    x       = c.execute("SELECT * FROM users WHERE username = (%s)",  (thwart(username)))
    

I get the following error:

    
    
    Traceback (most recent call last):
    File "", line 1, in TypeError: must be impossible, not str
    

**this is MySQL version on my PC**

    
    
    +-------------------------+------------------------------+
    | Variable_name | Value
    
    +-------------------------+------------------------------+
    | innodb_version | 5.7.11
    
    | protocol_version | 10
    
    | slave_type_conversions |
    
    | tls_version | TLSv1,TLSv1.1
    
    | version | 5.7.11
    
    | version_comment | MySQL Community Server (GPL) |
    | version_compile_machine | x86_64
    
    | version_compile_os | Linux
    
    +-------------------------+------------------------------+
    


Answer: You are aware of the dangers of SQL injection. That's good.

You even use a very secure form of `execute`: _parametrized query_). When you
do your query this way, you do not need escaping at all. `execute` does it all
for you. Thus the solution is:

    
    
    x       = c.execute("SELECT * FROM users WHERE username = %
    

s", (username,))

You would need escaping if you did something like this (with the needed
`import`):

    
    
    x       = c.execute("SELECT * FROM users WHERE username = %s" %  escape_string(username))
    

For further discussion, have a look at [Python MySQL with
variables](http://stackoverflow.com/questions/775296/python-mysql-with-
variables)

