簡單的 userinfo 表

字串拼接 sql

import pymysql

# 測試環境的資料庫連線
conn = pymysql.connect(host='192.168.0.214', port=3306, user='root', passwd='123456', db='tmpdb')
cursor = conn.cursor()

# 字串拼接sql，使用者名稱和密碼都是亂寫
sql = 'select username, password from userinfo where username="%s" and password="%s"'
sql = sql %('yy" or 1=1 -- ', '11111')
cursor.execute(sql)
r = cursor.fetchone()
print(r)

cursor.close()
conn.close()

# 執行結果，正確取到數值
('klvchen', '123456')
 

正常的寫法

# __author__:"klvchen"
# date: 2018/12/12
import pymysql

conn = pymysql.connect(host='192.168.0.214', port=3306, user='root', passwd='123456', db='tmpdb')
cursor = conn.cursor()

cursor.execute('select username, password from userinfo where username="%s" and password="%s"', ('yy" or 1=1 -- ', '11111'))
r = cursor.fetchone()
print(r)

cursor.close()
conn.close()

# 執行結果，沒有取到數值
None