pymysql表名占位符

发布于 2025-01-24 11:07:50 字数 686 浏览 6 评论 0原文

我知道这已经问过一百万次，但似乎没有人提供替代方案...

所以这无效：

DW = pymysql.connect(...)
table = "myTable"
with DW.cursor() as cur:
    cur.execute("SELECT * FROM %s", (table,)) # error here
    data = cur.fetchall()

错误：

ProgrammingError: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''myTable'' at line 1")

PostgreSQL的Psycopg2 具有psycopg2.sql2.sql.sidifier 或ASIS基本上删除单个引号并充当查询中的标识符...是否有pymysql的等效物？

另外，其他答案使用字符串格式和其他容易受到SQL注入的方法 - 这是我想避免的。

原文

I know this has been asked a million times, but noone seems to provide an alternative...

So this doesn't work:

DW = pymysql.connect(...)
table = "myTable"
with DW.cursor() as cur:
    cur.execute("SELECT * FROM %s", (table,)) # error here
    data = cur.fetchall()

Error:

ProgrammingError: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''myTable'' at line 1")

psycopg2 for PostgreSQL has psycopg2.sql.Identifier or AsIs which basically removes the single quotes and acts as an identifier in the query...is there an equivalent for pymysql?

Also, other answers use string formatting and other methods that are vulnerable to SQL injection - this is something I want to avoid.

分享到QQ

分享到微博