["python","sql","string-formatting"]
Python SQL query string formatting

I'm trying to find the best way to format an sql query string. When I'm debugging my application I'd like to log to file all the sql query strings, and it is important that the string is properly formated. Option 1 def myquery(): sql = "select field1, field2, field3, field4 from table where condition1=1 and condition2=2" con = mymodule.get_connection() ... This is good for printing the sql string. It is not a good solution if the string is long and not fits the standard width of 80 characters. Option 2 def query(): sql = """ select field1, field2, field3, field4 from table where condition1=1 and condition2=2""" con = mymodule.get_connection() ... Here the code is clear but when you print the sql query string you get all these annoying white spaces. u'\nselect field1, field2, field3, field4\n_____from table\n____where condition1=1 \n_____and condition2=2' Note: I have replaced white spaces with underscore _, because they are trimmed by the editor Option 3 def query(): sql = """select field1, field2, field3, field4 from table where condition1=1 and condition2=2""" con = mymodule.get_connection() ... I don't like this option because it breaks the clearness of the well tabulated code. Option 4 def query(): sql = "select field1, field2, field3, field4 " \ "from table " \ "where condition1=1 " \ "and condition2=2 " con = mymodule.get_connection() ... I don't like this option because all the extra typing in each line and is difficult to edit the query also. For me the best solution would be Option 2 but I don't like the extra whitespaces when I print the sql string. Do you know of any other options?
Security disclaimer: DO NOT use any kind of string interpolation in SQL queries if the interpolated values can be manipulated by any attacker. See e.g. this question for an example of why this is dangerous, leading directly to SQL injection vulnerabilities. Use parametrized queries instead, which all database engines support. The only reason why the below answer is safe is that the interpolated strings are literals defined inside the same function (they are not related to any kind of user input). Sorry for posting to such an old thread -- but as someone who also shares a passion for pythonic 'best', I thought I'd share our solution. The solution is to build SQL statements using python's String Literal Concatenation (http://docs.python.org/), which could be qualified a somewhere between Option 2 and Option 4 Code Sample: sql = ("SELECT field1, field2, field3, field4 " "FROM table " "WHERE condition1=1 " "AND condition2=2;") Works as well with f-strings: fields = "field1, field2, field3, field4" table = "table" conditions = "condition1=1 AND condition2=2" sql = (f"SELECT {fields} " f"FROM {table} " f"WHERE {conditions};") Pros: It retains the pythonic 'well tabulated' format, but does not add extraneous space characters (which pollutes logging). It avoids the backslash continuation ugliness of Option 4, which makes it difficult to add statements (not to mention white-space blindness). And further, it's really simple to expand the statement in VIM (just position the cursor to the insert point, and press SHIFT-O to open a new line).