python 变量 fields_Python mysql使用变量选择某个字段

Having a little tricky issue with python and mysql. To keep it simple, the following code returns whatever is in the variable 'field', which is a string. Such as 'username' or 'password'.

options = [field, userID]

entries = cursor.execute('select (?) from users where id=(?)', options).fetchall()

print(entries);

This code works correctly if I remove the first (?) and just use the actually name (like 'username') instead. Can anyone provide some input?

解决方案

Your query is actually formed as:

select "field" from users where id="value"

which returns you a string "field" instead of the actual table field value.

You cannot parameterize column and table names (docs):

Parameter placeholders can only be used to insert column values. They

can not be used for other parts of SQL, such as table names,

statements, etc.

Use string formatting for that part:

options = [userID]

query = 'select {field} from users where id=(?)'.format(field=field)

cursor.execute(query, options).fetchall()

Related threads with some more explanations: