主页 / 问题 / 908754
Accepted
cruim
Asked:2020-11-20 00:29:09 +0000 UTC2020-11-20 00:29:09 +0000 UTC

如何逃避 SQL 查询以避免 SQL 注入？[复制]

  • 772

如何对 SQL 查询进行转义以避免SQL 注入？

def getStackArea(screen_area):
    db = postgresql.open(db_conf.connectionString())
    data = db.query("select stack_area from screen_coordinates where screen_area = " + screen_area + " and active = 1")
    return data[0]['stack_area']
python

1 个回答

  1. Best Answer

    例子：

    conn = psycopg2.connect(dsn)
cur = conn.cursor()
q = "select stack_area from screen_coordinates where screen_area = ? and active = ?"

cur.execute(sql, (screen_area,1))
row = cur.fetchone()
stack_area = row[0]

    或使用py-postgresql：

    q = "select stack_area from screen_coordinates where screen_area = $1 and active = $2"
row = db.query.first(sql, (screen_area,1))
...

    PS 看起来参数化py-postgresql没有完全实现，如 PEP-249 中所述

    • 3

相关问题