pymysql SELECT query with field of table that the user gives as input

Question

i wondering if it's possible to make a query with select with the user give the field of table and the value that want. For example:

field=input("Field: ")
value=input("Value: ")
cursorobject.execute('SELECT id FROM users WHERE {}=\'{}\'')
result=cursorobject.fetchall()
for x in result:
     print(x)

and if it's not possible , there is any way to do it?

PS: this one not working

Answer 1

Of course you can construct the text of your query as you want using variables. E.g.

query = 'SELECT id FROM users WHERE {}=\'{}\''
print(query.format(field,value))

But, have in mind that you should validate very well the contents of the variables, before executing the query, to avoid SQL injections. For example the contents of the variables should not contain quotes.

E.g. the below code, with the specific values of the variables, will return the full list of users:

field='name'
value='name\' or \'1\'=\'1'
query = 'SELECT id FROM users WHERE {}=\'{}\''
print(query.format(field,value))

The produced query would be:

SELECT id FROM users WHERE name='name' or '1'='1'

Following your edit, you should replace your 3rd line with:

cursorobject.execute('SELECT id FROM users WHERE {}=\'{}\''.format(field,value))

And for making the best to avoid sql injections, you should use the built-in query parameterization features of your framework - pymysql:

cursorobject.execute('SELECT id FROM users WHERE {}=%s'.format(field),(value))