python and mysql.connector requires quoting of unsigned int -

i'm using mysql connector 1.0.9. , python 3.2

this query fails due syntax error (mysql.connector throws programmingerror, specific mysql error "there syntax error right of "%(ip)s , date_sub(now(), interval 1 hour) < accessed":

select count(*) bad_ip_logins ip = %(ip)s , date_sub(now(), interval 1 hour) < accessed 

but if quote variable ip, works:

select count(*) bad_ip_logins ip = '%(ip)s' , date_sub(now(), interval 1 hour) < accessed 

in context:

ip = 1249764151  # ip converted int conn = mysql.connector.connect(db_params) curs = conn.cursor() query = "select count(*) bad_ip_logins ip = %(ip)s , date_sub(now(), interval 1 hour) < accessed" params = {'ip', ip} curs.execute(query, params) 

my understanding never have quote variables prepared statement (and true every other query in code, ones access ip variable on table). why need quote in single instance, , else?

if isn't doing prepared statement i'd interested in hearing well. wasn't able inject - quoting in such way prevent that?

if matters, table description:

+----------+------------------+------+-----+---------+-------+ | field    | type             | null | key | default | | +----------+------------------+------+-----+---------+-------+ | ip       | int(10) unsigned | yes  |     | null    |       | | user_id  | int(11)          | yes  |     | null    |       | | accessed | datetime         | yes  |     | null    |       | +----------+------------------+------+-----+---------+-------+ 

do not use string interpolation. leave sql parameter database adapter:

cursor.execute('''\     select count(*) bad_ip_logins ip = %s , date_sub(now(), interval 1 hour) < accessed''', (ip,)) 

here, pass parameter ip in execute() call separate parameter (in tuple, make sequence), , database adapter take care of proper quoting, filling in %s placeholder.