Variable substitution in SQLite Python

Question

I have the following Python code and it gives me errors when I execute it, the error says

sqlite3.OperationalError: near "%": syntax error

statement = "INSERT INTO %s (%s) VALUES " % (table,columns) + "(%s,%s,%s);"
cur.execute(statement, (index,fullpath,filename))

Answer 1

SQL parameters are handled by the database, not by Python, so the syntax is not necessarily the same as Python's.

In SQLite (and most other databases), parameters are marked with a ?:

statement = "INSERT INTO %s (%s) VALUES (?,?,?);" % (table,columns)
cur.execute(statement, (index,fullpath,filename))