Bugfix : Fix issue caused by converting SQL insert queries to f-strings without proper variable conversion

Description Changes made to the queries in databaseconnect.py where insert queries’ strings were converted to f-strings are causing SQL failures in certain cases.

Example

INSERT INTO question_table(subject,root_word,verb,sentence) VALUES ('['distance']','what','[]','what is the distance between Nagpur and MUmbai?')

The variables are lists of strings and are thus appearing as lists in the query which is then truncated as a string at '['. This needs to be fixed in such a way that queries run in all cases.

Additionally, since the variables are a list, the cases where the length is more than one need to be handled in a better way. However, this wasn’t present in the first version itself and is more of an enhancement than a bugfix. @vishakha-lall I think that should be taken up in another issue.

Pre-requisite Intermediate knowledge of Python

[chttrjeankr]

long_data_used

Seeing the above word in the error I get an instinct that you may not be converting each argument to string explicitly. I think that needs to be done. Maybe, that’ll solve it.

Not totally a wild guess though. If you browse the history of the file databseconnect.py you’ll see typecasting existed before a PR was merged. Look here @Pihu1998.

The discussion is here and the doubts existed here.

[janakrajchadha]

@Pihu1998 Thanks for these references, this makes it quite clear why any sort of string formatting would be vulnerable to attacks. Please go ahead and make the changes using the sql module’s functions.