python注入sql_Python--sql注入

import pymysql

conn = pymysql.connect(host='211.149.218.16', user='jxz', password='123456', db='jxz', port=3306, charset='utf8')

cur = conn.cursor(cursor=pymysql.cursors.DictCursor)

name = 'zdq'

sex = 0

cur.execute('select * from bt_stu where real_name=%s and sex=%s', (name, sex)) # 可以防止sql注入

print(cur.fetchall())

def test(a, b):

print(a, b)

li = [1, 2]

test(*li)

d = {'a': '123', 'b': '456'}

test(**d)

def op_mysql_new(sql1, *data):

# 利用*data可变参数，就能防止sql注入

print(sql1)

print(data)

cur.execute(sql1, data)

print(cur.fetchall())

sql = 'select * from user where username=%s and id=%s'

name = 'haha'

id1 = 140

op_mysql_new(sql, name, id1)

# 同时执行多个sql executemany

sql = 'insert into seq (blue,red,date) values (%s,%s,%s)'

all_res = [

['16', '01,02,03,05,09,06', '2018-01-28'],

['15', '01,02,03,05,09,06', '2018-01-28'],

['14', '01,02,03,05,09,06', '2018-01-28'],

['13', '01,02,03,05,09,06', '2018-01-28'],

['13', '01,02,03,05,09,06', '2018-01-28'],

['13', '01,02,03,05,09,06', '2018-01-28'],

['13', '01,02,03,05,09,06', '2018-01-28'],

['13', '01,02,03,05,09,06', '2018-01-28'],

['13', '01,02,03,05,09,06', '2018-01-28'],

['13', '01,02,03,05,09,06', '2018-01-28'],

['13', '01,02,03,05,09,06', '2018-01-28'],

['13', '01,02,03,05,09,06', '2018-01-28'],

]

cur.executemany(sql, all_res)

conn.commit()