Passing a python parameter into MySQL

Question

I am trying to use my session parameter created in my login flask app to query my MySQL database. However, I think I'm going about this the wrong way. If I pass a username as a string into the sql string it works fine. Here is my flask app:

def home():
    try:
        if session.get('user'):
            _user = session.get('user')
           
            cursor.execute("SELECT name, position, team from player_position_team WHERE assigned_to = _user")
            conn.commit()
            data = cursor.fetchall()
            if len(data) == 0 and _user == 'all':
                cursor.execute("SELECT name, position, team from player_position_team")
                conn.commit()
                data = cursor.fetchall()
            return render_template('home.html', data=data)
        return render_template('home.html', data=data)
    except Exception as e:
        return render_template('error.html', error = str(e))

question from:https://stackoverflow.com/questions/65906746/passing-a-python-parameter-into-mysql

Answer 1

_user = session.get('user')
cursor.execute("SELECT name, position, team from player_position_team WHERE assigned_to = _user")

Should be:

cursor.execute("SELECT name, position, team from player_position_team WHERE assigned_to = %s", (session.get('user')))