sql注入和防sql注入

sql注入：

 from pymysql import *

 def main():

     # 创建连接

     conn = connect(host="127.0.0.1", port=3306, database="python_1", user="root", password="mysql", charset="utf8")

     # 创建cursor对象

     cursor = conn.cursor()

     find_name = input("请输入要查询的商品名称：")  # ' or 1=1 or '1

     # sql = "select * from test;"

     sql = """select * from test where name='%s';""" % find_name;

     # 打印sql语句

     print("------->%s<------" % sql)  # select * from test where name='' or 1=1 or '1';

     # 执行sql语句

     cursor.execute(sql)

     for temp in cursor.fetchall():

         print(temp)             # (1, 'laoli') (2, 'zhangsan') (3, 'laowang')

     # 关闭数据库

     cursor.close()

     conn.close()

 if __name__ == '__main__':

     main()

结果：

请输入要查询的商品名称：' or 1=1 or '1

------->select * from test where name='' or 1=1 or '1';<------

(1, 'laoli')

(2, 'zhangsan')

(3, 'laowang')

　　

防sql注入：

 from pymysql import *

 def main():

     # 创建连接

     conn = connect(host="127.0.0.1", port=3306, database="python_1", user="root", password="root", charset="utf8")

     # 创建cursor对象

     cursor = conn.cursor()

     find_name = input("请输入要查询的商品名称：")  # ' or 1=1 or '1

     sql = "select * from test where name=%s"

     # 打印sql语句

     print("------->%s<------" % sql)  # select * from test where name=%s;

     # 执行sql语句 把find_name放在中括号中传到execute()方法中去

     cursor.execute(sql,(find_name,))  # excute(sql语句，元祖） 元祖里放参数

     for temp in cursor.fetchall():

         print(temp)             #

     # 关闭数据库

     cursor.close()

     conn.close()

 if __name__ == '__main__':

     main()

结果：

请输入要查询的商品名称：' or 1=1 or '1

------->select * from test where name=%s<------

进程已结束,退出代码0