prevent apostroph catastrophic failure

dashApp/app_components.py

@@ -148,8 +148,8 @@ class SharedComponent():
         """
         con = sqlite3.connect(settings.BDDPM)
         dfmap = pd.read_sql(
-            "SELECT * FROM metadata_station WHERE abbrv in ('{stations}') OR name IN ('{stations}');".format(
-                stations="', '".join(stations)
+            'SELECT * FROM metadata_station WHERE abbrv in ("{stations}") OR name IN ("{stations}");'.format(
+                stations='", "'.join(stations)
             ),
             con=con
         )
@@ -277,8 +277,8 @@ class SharedComponent():
     def get_map_figure(self, stations, selected=None):
         con = sqlite3.connect(settings.BDDPM)
         dfmap = pd.read_sql(
-            "SELECT * FROM metadata_station WHERE abbrv in ('{stations}') OR name in ('{stations}');".format(
-                stations="', '".join(stations)
+            'SELECT * FROM metadata_station WHERE abbrv in ("{stations}") OR name in ("{stations}");'.format(
+                stations='", "'.join(stations)
             ),
             con=con
         )
@@ -623,8 +623,8 @@ class SOURCESComponents():
         """
         con = sqlite3.connect(settings.BDDSOURCES)
         dfmap = pd.read_sql(
-            "SELECT * FROM metadata_station WHERE abbrv in ('{stations}') OR name in ('{stations}');".format(
-                stations="', '".join(stations)
+            'SELECT * FROM metadata_station WHERE abbrv in ("{stations}") OR name in ("{stations}");'.format(
+                stations='", "'.join(stations)
             ),
             con=con
         )

dashApp/callbacks.py

@@ -146,9 +146,9 @@ def register_callbacks(app):
         """Get all possible source given the stations
         """
         sources=[]
-        sql = "SELECT * FROM PMF_contributions WHERE station IN ('{stations}')"
+        sql = 'SELECT * FROM PMF_contributions WHERE station IN ("{stations}")'
         stations_mapped = [STATIONS_LONG2SHORT.get(s, s) for s in stations]
-        sql = sql.format(stations="', '".join(stations_mapped))
+        sql = sql.format(stations='", "'.join(stations_mapped))
         dftmp = pd.read_sql(sql, con=sqlite3.connect(settings.BDDPM))\
                 .dropna(axis=1, how="all")
         sources = list( set(dftmp.columns) - set(BASE_VAR_SRC) - set(["index"]) )

dashApp/utilities.py

@@ -34,18 +34,22 @@ def get_contribution(sources, species, stations):
     if len(sources) > 0:
         conn = sqlite3.connect(settings.BDDSOURCES)
         contrib = pd.read_sql(
-            "SELECT * FROM contributions_constrained\
-            WHERE station in ('{stations}');".format(
-                stations="', '".join(stations)
+            """
+            SELECT * FROM contributions_constrained\
+            WHERE station in ("{stations}");
+            """.format(
+                stations='", "'.join(stations)
             ),
             con=conn,
             parse_dates=["Date"],
             index_col=["Station", "Date"]
         ).drop("index", axis=1)
         profile = pd.read_sql(
-            "SELECT * FROM profiles_constrained\
-            WHERE station in ('{stations}');".format(
-                stations="', '".join(stations)
+            """
+            SELECT * FROM profiles_constrained
+            WHERE station in ("{stations}");
+            """.format(
+                stations='", "'.join(stations)
             ),
             con=conn,
             index_col=["Station", "Specie"],
@@ -279,14 +283,18 @@ def get_values(table, cols, where=None, isin=None, base_var=None, DBpath=None):
         var_values += base_var
 
     if where and isin:
-        sqlquery = "SELECT \"{cols}\" FROM {table} WHERE {where} IN ('{isin}')".format(
+        sqlquery = """
+        SELECT \"{cols}\" FROM {table} WHERE {where} IN ("{isin}")
+        """.format(
             cols='\", \"'.join(var_values),
             table=table,
             where=where,
-            isin="', '".join(isin)
+            isin='", "'.join(isin)
         )
     else:
-        sqlquery = "SELECT \"{cols}\" FROM {table}".format(
+        sqlquery = """
+        SELECT \"{cols}\" FROM {table}
+        """.format(
             cols='\", \"'.join(var_values),
             table=table,
         )