I will not repeat what has been already said in the other, excellent, answer by @avazula.
You open a few files, but never close them. This might lead to bad things. Instead just use the with
keyword, which takes care of closing the file, even if an exception occurs. In addition, you can just iterate over a file and it will iterate over the lines. No need for readlines
, which reads the whole file into memory (which might not be possible).
with open(filePath) as read_file:
for line in read_file:
...
Python has an official style-guide, PEP8, which programmers are encouraged to follow. It recommend using lower_case
for variables and functions, not camelCase
.
An important thing to think about any time you use SQL are SQL injections. If there is any chance at all that a user can manipulate the content of the variables, they might be able to execute a malicious query if you are not careful.
The psycopg2
documentation even has this not so subtle warning:
Warning: Never, never, NEVER use Python string concatenation (
+
) or string parameters interpolation (%
) to pass variables to a SQL query string. Not even at gunpoint.
To alleviate this, prepared statements exist, which take care of properly escaping input. Theyyou can be used like thisuse the second argument of execute
, as mentioned in the psycopg2
documentationdocumentation:
cur_psql.execute(f"INSERT INTO {table}"
" (created_date, product_sku, previous_stock , current_stock)"
" VALUES (%s, %s, %s, %s)",
(date_part1+ " "+ date_part2, sku, prev_stock, current_stock))
Here I have used an f-string
(Python 3.6+) to insert the table name (unescaped in this case). You can properly escape it using sql.LiteralIdentifier(table)
as mentioned in the other answer.