Re: Problem inserting data from form

[Andy Dustman]

First of all, you are using the string formatting operator (%) to substitute parameters. Don't do that. Do this instead:

cursor.execute=( "INSERT INTO entries (Joke, User) VALUES (%s,%s)", (form['joke'].value, form['user'].value) );

Doing it this way causes it to quote any special characters in your input data, which prevents SQL injection attacks.

Second of all, you have to call connection.commit() to save your data.

You should read PEP-249: http://www.python.org/dev/peps/pep-0249/ And other MySQLdb documentation: http://mysql-python.sourceforge.net/