如何在mysql查詢中使用python傳遞變量名稱

Question

如果我在字段中給出靜態值，則插入Myquery，但如果我給出變量名稱，則會拋出異常。 我的工作代碼

import MySQLdb 
import datetime 

db = MySQLdb.connect("localhost","root","pass","selvapractice") 

cursor = db.cursor() 

sql = "INSERT INTO selva(name) \ 
     VALUES ('Selva') " 
try: 
    cursor.execute(sql) 
    db.commit() 
except: 
    print "dffds" 
    db.rollback() 

db.close() 

我的異常代碼

import MySQLdb 
import datetime 

db = MySQLdb.connect("localhost","root","pass","selvapractice") 

cursor = db.cursor() 
a="surya" 
sql = "INSERT INTO selva(name) \ 
     VALUES (%s) " %(a) 
try: 
    cursor.execute(sql) 
    db.commit() 
except: 
    print "dffds" 
    db.rollback() 

db.close() 

它打印dfffds

如何查詢給變量的名字嗎？任何幫助將不勝感激！

Answer 1

試試這個： 注意我是如何傳遞變量作爲一個參數去執行功能，這是更好的防止SQL注入攻擊。

import MySQLdb 
import datetime 

db = MySQLdb.connect("localhost","root","pass","selvapractice") 

cursor = db.cursor() 
a="surya" 
b="male" 
sql = "INSERT INTO selva(name, gender) VALUES (%s, %s)" 
try: 
    cursor.execute(sql, [a, b]) 
    db.commit() 
except: 
    print "dffds" 
    db.rollback() 

db.close() 

Answer 2

嘗試

INSERT INTO table_name (name) VALUES ('selva')