Python--sql註入
阿新 • • 發佈：2018-02-03
pymysql set red () log .exe password -s 執行
import pymysql
conn = pymysql.connect(host=‘211.149.218.16‘, user=‘jxz‘, password=‘123456‘, db=‘jxz‘, port=3306, charset=‘utf8‘)
cur = conn.cursor(cursor=pymysql.cursors.DictCursor)
name = ‘zdq‘
sex = 0
cur.execute(‘select * from bt_stu where real_name=%s and sex=%s‘, (name, sex)) # 可以防止sql註入
print(cur.fetchall())
def test(a, b):
print(a, b)
li = [1, 2]
test(*li)
d = {‘a‘: ‘123‘, ‘b‘: ‘456‘}
test(**d)
def op_mysql_new(sql1, *data):
# 利用*data可變參數，就能防止sql註入
print(sql1)
print(data)
cur.execute(sql1, data)
print(cur.fetchall())
sql = ‘select * from user where username=%s and id=%s‘
name = ‘haha‘
id1 = 140
op_mysql_new(sql, name, id1)
# 同時執行多個sql executemany
sql = ‘insert into seq (blue,red,date) values (%s,%s,%s)‘
all_res = [
[‘16‘, ‘01,02,03,05,09,06‘, ‘2018-01-28‘],
[‘15‘, ‘01,02,03,05,09,06‘, ‘2018-01-28‘],
[‘14‘, ‘01,02,03,05,09,06‘, ‘2018-01-28‘],
[‘13‘, ‘01,02,03,05,09,06‘, ‘2018-01-28‘],
[‘13‘, ‘01,02,03,05,09,06‘, ‘2018-01-28‘],
[‘13‘, ‘01,02,03,05,09,06‘, ‘2018-01-28‘],
[‘13‘, ‘01,02,03,05,09,06‘, ‘2018-01-28‘],
[‘13‘, ‘01,02,03,05,09,06‘, ‘2018-01-28‘],
[‘13‘, ‘01,02,03,05,09,06‘, ‘2018-01-28‘],
[‘13‘, ‘01,02,03,05,09,06‘, ‘2018-01-28‘],
[‘13‘, ‘01,02,03,05,09,06‘, ‘2018-01-28‘],
[‘13‘, ‘01,02,03,05,09,06‘, ‘2018-01-28‘],
]
cur.executemany(sql, all_res)
conn.commit()
Python--sql註入