Use "%s" in sql query

* wqflask/base/mrna_assay_tissue_data.py: Delete db_tools.
(MrnaAssayTissueData.get_symbol_values_pairs): Re-format query.
* wqflask/tests/unit/base/test_mrna_assay_tissue_data.py:
(test_get_trait_symbol_and_tissue_values): Add test for above.

1 files changed, 8 insertions, 6 deletions

diff --git a/wqflask/base/mrna_assay_tissue_data.py b/wqflask/base/mrna_assay_tissue_data.py
index a229151d..9a86134e 100644
--- a/wqflask/base/mrna_assay_tissue_data.py
+++ b/wqflask/base/mrna_assay_tissue_data.py
@@ -1,6 +1,5 @@
 import collections
 
-from utility import db_tools
 from utility import Bunch
 
 
@@ -82,13 +81,16 @@ class MrnaAssayTissueData:
         symbol_values_dict = {}
 
         if len(id_list) > 0:
-            query = """SELECT TissueProbeSetXRef.Symbol, TissueProbeSetData.value
-                       FROM TissueProbeSetXRef, TissueProbeSetData
-                       WHERE TissueProbeSetData.Id IN {} and
-                             TissueProbeSetXRef.DataId = TissueProbeSetData.Id""".format(db_tools.create_in_clause(id_list))
             results = []
             with self.conn.cursor() as cursor:
-                cursor.execute(query)
+                cursor.execute(
+                    "SELECT TissueProbeSetXRef.Symbol, "
+                    "TissueProbeSetData.value FROM "
+                    "TissueProbeSetXRef, TissueProbeSetData "
+                    "WHERE TissueProbeSetData.Id IN ("
+                    f"{', '.join(['%s' * len(id_list)])}) "
+                    "AND TissueProbeSetXRef.DataId = TissueProbeSetData.Id",
+                    tuple(id_list))
                 results = cursor.fetchall()
                 for result in results:
                     (symbol, value) = result