多条件查询语句，避免sql拼接引起sql注入写法

para_count =  (name,name,usertype,usertype)
sql_count = """ select count(*) as counts from users where v_account_type !='tequia'
             AND (%s is NULL or v_username = %s)
             AND (%s is NULL or v_account_type = %s)"""

cursor = g.cursor cursor.execute(sql, para)

 

 

参考http://www.cnblogs.com/yucaiyun/p/7101723.html

程序员学习公众号: