sqlite3.OperationalError: unrecognized token: "01T00" Python datestamp

Question

I'm experiencing a problem inserting values into a SQLite database. The data I download from the Norwegian Parliament site data.stortinget.no. The error I get is: sqlite3.OperationalError: unrecognized token: "01T00"

Here is the method in which the error occur: (I know about the indentation error in this excerpt)

def get_perioder(cur):
DOK = "stortingsperioder"
try:
     page = urllib2.urlopen(SITE+DOK)
except:
    print "Failed to fetch item "+DOK
if page:
    tree = ElementTree.parse(page)
    root = tree.getroot()
    top = list(root)[2]
    elements = list(top)
    for el in elements:
        fra = el.find('{http://data.stortinget.no}fra').text
        per_id = el.find('{http://data.stortinget.no}id').text
        til = el.find('{http://data.stortinget.no}til').text
        print "id: %s fra: %s til: %s" % (per_id, fra, til)
        cur.execute("INSERT INTO perioder(fra, id, til) VALUES(%s,%s,%s)" % (fra, per_id, til))
else:
    print "Could not load page: "+DOK

The message printed by the print just above cur.execute is: id: 2009-2013 fra: 2009-10-01T00:00:00 til: 2013-09-30T23:59:59 The whole error trace is:

BigMac:Stortingsdata ola$ python getBasicData.py 
id: 2009-2013 fra: 2009-10-01T00:00:00 til: 2013-09-30T23:59:59
Traceback (most recent call last):
  File "getBasicData.py", line 169, in <module>
    get_perioder(cur)
   File "getBasicData.py", line 26, in get_perioder
     cur.execute("INSERT INTO perioder(fra, id, til) VALUES(%s,%s,%s)" % (fra, per_id, til))
 sqlite3.OperationalError: unrecognized token: "01T00"

I referred with the SQLite manual and it seems that the format is supported, so I'm wondering where the problem come from.

Answer 1

The proper way is to use a parametrized query.
Example:

cur.execute("""INSERT INTO perioder(fra, id, til) 
               VALUES (?,?,?);""", (fra, per_id, til))

There is a specific parameter "style" for each database driver.
In the case of SQLite that parameter style is ?.

Also note that the parameter values are passed as a second argument to execute().
Using string-interpolation leaves you vulnerable to all kinds of quoting issues (like the one that brought you here) and the possibility of SQL-injection attack.

For more information please read the DB-API and the database programming wiki.