Pyhton中防止SQL注入的方法

复制代码 代码如下:
c=db.cursor()
max_price=5
c.execute(\”\”\”SELECT spam, eggs, sausage FROM breakfast
          WHERE price < %s\”\”\”, (max_price,))

注意，上面的SQL字符串与后面的tuple之间的分隔符是逗号，平时拼写SQL用的是%。

如果按照以下写法，是容易产生SQL注入的：

复制代码 代码如下:
c.execute(\”\”\”SELECT spam, eggs, sausage FROM breakfast
          WHERE price < %s\”\”\” % (max_price,))

这个和PHP里的PDO是类似的，原理同MySQL Prepared Statements。

Python

Using the Python DB API, don\’t do this:

# Do NOT do it this way.

复制代码 代码如下:
cmd = \”update people set name=\’%s\’ where id=\’%s\’\” % (name, id) curs.execute(cmd)

Instead, do this:
复制代码 代码如下:
cmd = \”update people set name=%s where id=%s\” curs.execute(cmd, (name, id))

Note that the placeholder syntax depends on the database you are using.
复制代码 代码如下:\’qmark\’ Question mark style, e.g. \’…WHERE name=?\’ \’numeric\’ Numeric, positional style, e.g. \’…WHERE name=:1\’ \’named\’ Named style, e.g. \’…WHERE name=:name\’ \’format\’ ANSI C printf format codes, e.g. \’…WHERE name=%s\’ \’pyformat\’ Python extended format codes, e.g. \’…WHERE name=%(name)s\’

The values for the most common databases are:

复制代码 代码如下:
>>> import MySQLdb; print MySQLdb.paramstyle format >>> import psycopg2; print psycopg2.paramstyle pyformat >>> import sqlite3; print sqlite3.paramstyle qmark

So if you are using MySQL or PostgreSQL, use %s (even for numbers and other non-string values!) and if you are using SQLite use ?