pymysql如何解决sql注入问题深入讲解

import pymysql

sql = 'SELECT count(*) as count FROM user WHERE id = ' + str(input['id']) + ' AND password = "' + input['password'] + '"'
cursor = dbclient.cursor(pymysql.cursors.DictCursor)
cursor.execute(sql)
count = cursor.fetchone()
if count is not None and count['count'] > 0:
 print('登陆成功')

input['id'] = '2 or 1=1'

import pymysql

sql = 'SELECT count(*) as count FROM user WHERE id = %s AND password = %s'
valus = [input['id'], input['password']]
cursor = dbclient.cursor(pymysql.cursors.DictCursor)
cursor.execute(sql, values)
count = cursor.fetchone()
if count is not None and count['count'] > 0:
 print('登陆成功')

delimiter \DROP PROCEDURE IF EXISTS proc_sql \CREATE PROCEDURE proc_sql (
 in nid1 INT,
 in nid2 INT,
 in callsql VARCHAR(255)
)
BEGIN
 set @nid1 = nid1;
 set @nid2 = nid2;
 set @callsql = callsql;
 PREPARE myprod FROM @callsql;
 -- PREPARE prod FROM 'select * from tb2 where nid>"htmlcode">

import pymysql

cursor = conn.cursor()
mysql="SELECT * FROM user where nid > "
cursor.callproc('proc_sql', args=(11, 15, mysql))
rows = cursor.fetchall()
conn.commit()


总结
以上就是这篇文章的全部内容了，希望本文的内容对大家的学习或者工作具有一定的参考学习价值，如果有疑问大家可以留言交流，谢谢大家对的支持。