如何在Python中使用SQL語句中的變量？好吧，我對Python沒什么經(jīng)驗。我有以下Python代碼：cursor.execute("INSERT INTO table VALUES var1, var2, var3,")哪里var1是整數(shù)，var2 & var3是弦樂。如果沒有python作為查詢文本的一部分，我如何編寫變量名？
3 回答
慕慕森
TA貢獻1856條經(jīng)驗 獲得超17個贊
很多方法。別使用最明顯的(%s帶著%)在實際代碼中，它對攻擊.
# Never do this -- insecure!
symbol = 'RHAT'
c.execute("SELECT * FROM stocks WHERE symbol = '%s'" % symbol)
# Do this instead
t = ('RHAT',)
c.execute('SELECT * FROM stocks WHERE symbol=?', t)
print c.fetchone()
# Larger example that inserts many records at a time
purchases = [('2006-03-28', 'BUY', 'IBM', 1000, 45.00),
? ? ? ? ? ? ?('2006-04-05', 'BUY', 'MSFT', 1000, 72.00),
? ? ? ? ? ? ?('2006-04-06', 'SELL', 'IBM', 500, 53.00),
? ? ? ? ? ? ]
c.executemany('INSERT INTO stocks VALUES (?,?,?,?,?)', purchases)
如果您需要更多的示例：
# Multiple values single statement/execution
c.execute('SELECT * FROM stocks WHERE symbol=? OR symbol=?', ('RHAT', 'MSO'))
print c.fetchall()
c.execute('SELECT * FROM stocks WHERE symbol IN (?, ?)', ('RHAT', 'MSO'))
print c.fetchall()
# This also works, though ones above are better as a habit as it's inline with syntax of executemany().. but your choice.
c.execute('SELECT * FROM stocks WHERE symbol=? OR symbol=?', 'RHAT', 'MSO')
print c.fetchall()
# Insert a single item
c.execute('INSERT INTO stocks VALUES (?,?,?,?,?)', ('2006-03-28', 'BUY', 'IBM', 1000, 45.00))
交互式愛情
TA貢獻1712條經(jīng)驗 獲得超3個贊
cursor.execute("INSERT?INTO?table?VALUES?(%s,?%s,?%s)",?(var1,?var2,?var3))注意，參數(shù)作為元組傳遞。
數(shù)據(jù)庫API對變量進行適當(dāng)?shù)霓D(zhuǎn)義和引用。小心不要使用字符串格式運算符(%)，因為
- 它不做任何逃避或引用。
- 它容易受到不受控制的字符串格式攻擊。
添加回答
舉報
0/150
提交
取消