源码网商城,靠谱的源码在线交易网站 我的订单 购物车 帮助

源码网商城

Pyhton中防止SQL注入的方法

  • 时间:2022-01-27 17:18 编辑: 来源: 阅读:
  • 扫一扫,手机访问
摘要:Pyhton中防止SQL注入的方法
[url=http://wiki.python.org/moin/DatabaseProgramming/]Python DB API[/url], don't do this: # Do NOT do it this way.
[u]复制代码[/u] 代码如下:
cmd = "update people set name='%s' where id='%s'" % (name, id) curs.execute(cmd)
Instead, do this:
[u]复制代码[/u] 代码如下:
cmd = "update people set name=%s where id=%s" curs.execute(cmd, (name, id))
Note that the placeholder syntax depends on the database you are using.
[u]复制代码[/u] 代码如下:
'qmark' Question mark style, e.g. '...WHERE name=?' 'numeric' Numeric, positional style, e.g. '...WHERE name=:1' 'named' Named style, e.g. '...WHERE name=:name' 'format' ANSI C printf format codes, e.g. '...WHERE name=%s' 'pyformat' Python extended format codes, e.g. '...WHERE name=%(name)s'
The values for the most common databases are:
[u]复制代码[/u] 代码如下:
>>> import MySQLdb; print MySQLdb.paramstyle format >>> import psycopg2; print psycopg2.paramstyle pyformat >>> import sqlite3; print sqlite3.paramstyle qmark
So if you are using MySQL or PostgreSQL, use %s (even for numbers and other non-string values!) and if you are using SQLite use ?
  • 全部评论(0)
联系客服
客服电话:
400-000-3129
微信版

扫一扫进微信版
返回顶部