 <p>you must not perform the substitutions yourself in a SQL query as this makes your code vulnerable to <a href="https://en.wikipedia.org/wiki/SQL_injection" rel="nofollow">SQL injections</a>. </p> <p>The correct version is:</p> <pre><code>cr.execute( 'select distinct(value) from ir_translation ' 'where name = %s and src = %s and res_id = %S and lang = %s', ('product.bat3,name', res_bat[j][0].encode('utf-8'), res_bat[j][1], line2.partner_id.lang) ) </code></pre> <p>You may keep the first parameter in the query if you wish. </p>