mysql 参数化传值,MySQL参数化查询

最新推荐文章于 2024-03-26 10:43:23 发布

弦歌缓缓

最新推荐文章于 2024-03-26 10:43:23 发布

阅读量229

点赞数

文章标签： mysql 参数化传值

I am having a hard time using the MySQLdb module to insert information into my database. I need to insert 6 variables into the table.

cursor.execute ("""

INSERT INTO Songs (SongName, SongArtist, SongAlbum, SongGenre, SongLength, SongLocation)

VALUES

(var1, var2, var3, var4, var5, var6)

""")

Can someone help me with the syntax here?

解决方案

Beware of using string interpolation for SQL queries, since it won't escape the input parameters correctly and will leave your application open to SQL injection vulnerabilities. The difference might seem trivial, but in reality it's huge.

Incorrect (with security issues)

c.execute("SELECT * FROM foo WHERE bar = %s AND baz = %s" % (param1, param2))

Correct (with escaping)

c.execute("SELECT * FROM foo WHERE bar = %s AND baz = %s", (param1, param2))

It adds to the confusion that the modifiers used to bind parameters in a SQL statement varies between different DB API implementations and that the mysql client library uses printf style syntax instead of the more commonly accepted '?' marker (used by eg. python-sqlite).