Python代码中的调用参数

我有以下代码，在调用时需要一个-p参数。但是，如何在SQL查询中调用-p参数？我还希望在输出文件名中使用这个-p参数文本

#!/usr/bin/python

import argparse
import psycopg2
import csv

parser = argparse.ArgumentParser(description='insert the project ID as an 
argument')
parser.add_argument('-p','--project_id', help='project_id to pull files from 
ERAPRO',required=True)
args = parser.parse_args()

conn = psycopg2.connect(database="XXX", user="XXX", password="XXX", 
host="XXX", port="5432")
cur = conn.cursor()

cur.execute("""SELECT project_analysis.project_accession, 
analysis.analysis_accession, file.filename, file.file_md5, file.file_location
    FROM project_analysis
    LEFT JOIN analysis on project_analysis.analysis_accession = analysis.analysis_accession
    LEFT JOIN analysis_file on analysis.analysis_accession = analysis_file.analysis_accession
    LEFT JOIN file on analysis_file.file_id = file.file_id
    WHERE project_accession = <INSERT -p ARGUMENT HERE> and analysis.hidden_in_eva = '0';""")

records = cur.fetchall()

with open ('/nfs/production3/eva/user/gary/evapro_ftp/<INSERT -p ARGUMENT 
HERE>.csv', 'w') as f:
writer = csv.writer (f, delimiter = ',')
for row in records:
    writer.writerow(row)

conn.close()

谢谢你的帮助

---

谢谢

首先使用dest argument将参数指定给变量以添加参数。假设我们将输入分配给project_id变量。 这样我们可以在代码中引用它

parser.add_argument('-p','--project_id', 
                     help='project_id to pull files from
                     ERAPRO',
                     required=True,
                     dest='project_id') # notice the dest argument

cur.execute("""SELECT project_analysis.project_accession, 
analysis.analysis_accession, file.filename, file.file_md5, file.file_location
    FROM project_analysis
    LEFT JOIN analysis on project_analysis.analysis_accession = analysis.analysis_accession
    LEFT JOIN analysis_file on analysis.analysis_accession = analysis_file.analysis_accession
    LEFT JOIN file on analysis_file.file_id = file.file_id
    WHERE project_accession = %s and analysis.hidden_in_eva = '0';""", (args.project_id))

请注意execute'…%的用法s…'，args.project_id通过这样做，我们将project_id引用的值插入字符串。

调用args=parser.parse_args后，您可以获得如下参数值：

pid=args.project\u id

然后，您可以通过使用普通字符串替换在代码中使用该pid值。但是，最好使用psycopg2的内置方法将参数传递给SQL查询，以防止SQL注入

正常字符串替换：

'hello world {]'.format(var_name)

psycopg2：

cur.execute('SELECT * from %s', (var_name))

---

我想您希望args.project\u id而不是project\u id作为执行语句的参数。谢谢您的帮助！