Insert python variable value into SQL table
Question: I have a password system that stores the password for a python program in an
SQL table. I want the user to be able to change the password in a tkinter
window but I am not sure how to use the value of a python variable as the
value for the SQL table. Here is a sample code:

    
    
    import tkinter
    from tkinter import *
    import sqlite3
    
    conn = sqlite3.connect('testDataBase')
    c = conn.cursor()
    
    c.execute("INSERT INTO info Values('test')")
    c.execute("SELECT password FROM info")
    password = (c.fetchone()[0])
    
    #Window setup
    admin = tkinter.Tk()
    admin.minsize(width=800, height = 600)
    admin.maxsize(width=800, height = 600)
    #GUI
    passwordChangeLabel = Label(admin, text="It is recommended to change your password after first login!", font=("Arial", 14))
    passwordChangeLabel.pack()
    
    passwordChangeCurrentPasswordLabel = Label(admin, text="Current Password: ", font=("Arial", 11))
    passwordChangeCurrentPasswordLabel.place(x=275, y=30)
    passwordChangeCurrentPasswordEntry = Entry(admin)
    passwordChangeCurrentPasswordEntry.place(x=405, y=32.5)
    
    passwordChangeNewPasswordLabel = Label(admin, text="New Password: ", font=("Arial", 11))
    passwordChangeNewPasswordLabel.place(x=295, y=50)
    passwordChangeNewPasswordEntry = Entry(admin)
    passwordChangeNewPasswordEntry.place(x=405, y=52.5)
    
    passwordChangeButton = Button(admin, text="Submit", width=20)
    passwordChangeButton.place(x=350, y=80)
    
    def changePasswordFunction(event):
        newPassword = passwordChangeNewPasswordEntry.get()
        enteredPassword = passwordChangeCurrentPasswordEntry.get()
        if enteredPassword == password:
            c.execute("REPLACE INTO info(password) VALUES(newPassword)")
        else:
            wrong = tkinter.Toplevel()
            wrong.minsize(width=200, height = 100)
            wrong.maxsize(width=200, height = 100)
            Label(wrong, text="Sorry that password is incorrect!", font=("Arial", 24), anchor=W, wraplength=180, fg="red").pack()
    
    admin.bind('<Return>', changePasswordFunction)
    passwordChangeButton.bind('<Button-1>', changePasswordFunction)
    

This code will bring up an error:

    
    
    sqlite3.OperationalError: no such column: newPassword
    

How can I properly replace the previous value in the password column with the
new entered password?


Answer: There are two valid ways to use `VALUES()`: with a label or a string literal.
A string literal is a string in single or double quotes.

Since you didn't put `newPassword` in quotes, Sqlite assumes `newPassword` is
a label, i.e. a column name. It goes looking for the value of the
`newPassword` field in the current record, and throws an error since that
field doesn't exist.

What you want to do is, take the value of the `newPassword` python variable
and put it in quotes. Here's a corrected query string (not tested):

    
    
    "REPLACE INTO info(password) VALUES('" + newPassword + "')"
    

As someone mentions in the comments, updating your database directly with user
inputs is highly insecure. Database interfaces generally provide easy ways to
sanitize all inputs, and you should make it a point to follow those practices.
A great resource with code examples from many popular languages is [Bobby
Tables](http://bobby-tables.com/). (Also note that failing to include
information about SQL security in your answers at SO can result in down-
votes.)

