c=db.cursor()

max_price=5

c.execute("""SELECT spam, eggs, sausage FROM breakfast

WHERE price < %s""", (max_price,))

注意，上面的SQL字符串與后面的tuple之間的分隔符是逗號，平時拼寫SQL用的是%。

如果按照以下寫法，是容易產生SQL注入的：

c.execute("""SELECT spam, eggs, sausage FROM breakfast

WHERE price < %s""" % (max_price,))

這個和PHP里的PDO是類似的，原理同MySQL Prepared Statements。

Python

Using the Python DB API, don't do this:

# Do NOT do it this way.

cmd = "update people set name='%s' where id='%s'" % (name, id) curs.execute(cmd)

Instead, do this:

cmd = "update people set name=%s where id=%s" curs.execute(cmd, (name, id))

Note that the placeholder syntax depends on the database you are using.

'qmark' Question mark style, e.g. '...WHERE name=?' 'numeric' Numeric, positional style, e.g. '...WHERE name=:1' 'named' Named style, e.g. '...WHERE name=:name' 'format' ANSI C printf format codes, e.g. '...WHERE name=%s' 'pyformat' Python extended format codes, e.g. '...WHERE name=%(name)s'

The values for the most common databases are:

>>> import MySQLdb; print MySQLdb.paramstyle format >>> import psycopg2; print psycopg2.paramstyle pyformat >>> import sqlite3; print sqlite3.paramstyle qmark

So if you are using MySQL or PostgreSQL, use %s (even for numbers and other non-string values!) and if you are using SQLite use ?

總結

以上是生活随笔為你收集整理的python防止源码泄露_Pyhton中防止SQL注入的方法的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。