How to Generate string to update in SQL with python - python-3.x

Question

I want to generate a string for updating values in SQL, from a python dict.
So far, I have the following:
def sqlquote(value):
"""Naive SQL quoting
All values except NULL are returned as SQL strings in single quotes,
with any embedded quotes doubled.
"""
if value is None:
return 'NULL'
return '"{}"'.format(str(value).replace("'", "''"))
part1="UPDATE products_list SET"
#This parts prints with the desired format, but I don't know how to create a string with this:
part2:
for key, value in article_dict.items():
print(key, '=', sqlquote(value))
part3="WHERE product_id=article_dict['product_id']
How can I "concat" the part2 of the string to make a unique string that can be used later to update a sqlite database?

Answer 1

The SQL you're producing isn't valid, since you're missing spaces between the different parts. Also, there's no need for the sqlquote function, it's better to use bound parameters:
values = []
sql = "UPDATE products_list SET "
# For each item in the dictionary, add to the SQL string
temp = []
for key, value in article_dict.items():
if key != 'product_id':
temp.append(f"{key}=?")
# And store the value in a seperate list
values.append(value)
# Concat the different set instructions
sql += ",".join(temp) + " "
# And add a WHERE clause to the end
sql += "WHERE product_id=?;"
values.append(article_dict['product_id'])
# TODO:
# db.execute(sql, values)