sql注入和防sql注入

sql注入：

 from pymysql import *

 def main():
     # 创建连接
     conn = connect(host="127.0.0.1", port=3306, database="python_1", user="root", password="mysql", charset="utf8")
     # 创建cursor对象
     cursor = conn.cursor()
     find_name = input("请输入要查询的商品名称：")  # ' or 1=1 or '1
     # sql = "select * from test;"
     sql = """select * from test where name='%s';""" % find_name;
     # 打印sql语句
     print("------->%s<------" % sql)  # select * from test where name='' or 1=1 or '1';
     # 执行sql语句
     cursor.execute(sql)
     for temp in cursor.fetchall():
         print(temp)             # (1, 'laoli') (2, 'zhangsan') (3, 'laowang')
     # 关闭数据库
     cursor.close()
     conn.close()

 if __name__ == '__main__':
     main()

结果：

请输入要查询的商品名称：' or 1=1 or '1
------->select * from test where name='' or 1=1 or '1';<------
(1, 'laoli')
(2, 'zhangsan')
(3, 'laowang')

　　

防sql注入：

 from pymysql import *

 def main():
     # 创建连接
     conn = connect(host="127.0.0.1", port=3306, database="python_1", user="root", password="root", charset="utf8")
     # 创建cursor对象
     cursor = conn.cursor()
     find_name = input("请输入要查询的商品名称：")  # ' or 1=1 or '1
     sql = "select * from test where name=%s"
     # 打印sql语句
     print("------->%s<------" % sql)  # select * from test where name=%s;
     # 执行sql语句 把find_name放在中括号中传到execute()方法中去
     cursor.execute(sql,(find_name,))  # excute(sql语句，元祖） 元祖里放参数
     for temp in cursor.fetchall():
         print(temp)             #
     # 关闭数据库
     cursor.close()
     conn.close()

 if __name__ == '__main__':
     main()

结果：

请输入要查询的商品名称：' or 1=1 or '1
------->select * from test where name=%s<------

进程已结束,退出代码0