title: Flask Python: MySQLdb, %s unable to access database (to prevent SQL injection)
body: <p>I am referring this post <a href="https://ianhowson.com/blog/a-quick-guide-to-using-mysql-in-python/" rel="nofollow noreferrer">https://ianhowson.com/blog/a-quick-guide-to-using-mysql-in-python/</a> that <code>%s</code> is prefer as it prevent SQL injection while <code>'%s'</code> is not. However, I try to convert a working code which used '%s' to %s, the code is not working anymore. It return error 500 with internal server error.</p>
  
  <pre><code>@app.route('/KTM/search', methods=['GET'])
  def KTM():
      db = MySQLdb.connect(host='xxx.mysql.pythonanywhere-services.com',user='xxx',passwd='xxx',db='jackie$default',cursorclass=MySQLdb.cursors.DictCursor)
      curs = db.cursor()
      name = request.args['name']
      valueMin = request.args['valueMin']
      valueMax = request.args['valueMax']
      volumeMin = request.args['volumeMin']
      volumeMax = request.args['volumeMax']
      macd = request.args['macd']
      stoch = request.args['stoch']
      bollinger = request.args['bollinger']
      rsi = request.args['rsi']
      atr = request.args['atr']
      trade = request.args['trade']
      limit = request.args['limit']
      offSet = request.args['offSet']
      query0 = "SELECT * FROM KTM WHERE Stock LIKE %s%% AND "
      query1 = "(Value BETWEEN (IF(%s='_',-5000,%s)) AND (IF(%s='_',5000,%s))) AND "
      query2 = "(Volume_changes_pc BETWEEN (IF(%s='_',-5000,%s)) AND (IF(%s='_',5000,%s))) AND "
      query3 = "MACD LIKE %s AND "
      query4 = "STOCH LIKE %s AND "
      query5 = "BOLLINGER LIKE %s AND "
      query6 = "RSI LIKE %s AND "
      query7 = "ATR LIKE %s AND "
      query8 = "TRADE LIKE %s LIMIT %s OFFSET %s"
      query = query0+query1+query2+query3+query4+query5+query6+query7+query8
      input = name,float(valueMin),float(valueMin),float(valueMax),float(valueMax),float(volumeMin),float(volumeMin),float(volumeMax),float(volumeMax),macd,stoch,bollinger,rsi,atr,trade,int(limit),int(offSet)
      try:
          curs.execute(query%(input))
          g = curs.fetchall()
      except Exception:
          return 'Error: unable to fetch items'
  
      return jsonify({'Stock': g})
  </code></pre>
  
  <p>I did change the input as float or int when it is numbers.
  I also check that the MySQL seems only taking <code>SELECT * FROM KTM WHERE Stock LIKE 'G%'</code>but not <code>SELECT * FROM KTM WHERE Stock LIKE G%</code>.
  How to make my code  roust to prevent SQL injection with %S?I am using Python 3.4 now</p>