I'm trying to add a row into my finance db using the code below (a few versions), but keeping getting an error saying I'm passing in too many variables to the execute() function. Any direction here would be great.


    username = request.form['username']
        #hash the password
    password = generate_password_hash(request.form['password'])

    #Execute sql to add value into db
    # Add to database by creating a row with :username, :password (hash)
    db.execute('''INSERT INTO users VALUES(?,?)''', (username, password))


db.execute('''INSERT INTO users(username, password) VALUES(?,?)''', (username, password))


db.execute("INSERT  INTO users (username, hash) VALUES (:username, :hash)", username, password)


"execute() takes 2 positional arguments but 3 were given"

1 Answer 1


There is no ? in cs50x 2018 version of sql; ":bound :variables" are used to mitigate sql injection attacks.

Of the three "options" this db.execute("INSERT INTO users (username, hash) VALUES (:username, :hash)", username, password) is closest to correct. But no cigar.

The part that's missing is where you tell the sql what to "substitute" for the bound variable.

The Hints section of the spec directs you to login for an example.
rows = db.execute("SELECT * FROM users WHERE username = :username", username=request.form.get("username"))

Notice the difference in syntax. In the Hints sql, username is set to something.

This error comes when the number of bound variables in the query argument does not match the number of additional arguments passed to execute.

  • Ah! Thanks so much. Just had to set the value equal to its variable name :)
    – Jake
    Aug 7, 2018 at 3:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .