将字典键值插入MySQL数据库

Question

我已执行此代码以将字典插入数据库中的表中，

d = {'err': '0', 'tst': '0', 'Type o': 'FTP', 'recip': 'ADMIN', 'id': '101', 'origin': 'REPORT', 'Type recip': 'SMTP', 'date': '2010-01-10 18:47:52'}

db = MySQLdb.connect("localhost","admin","password","database")
cursor = db.cursor()
cursor.execute("""INSERT INTO mytable(ID, ERR, TST, DATE, ORIGIN, TYPE_O, RECIP, TYPE_RECIP) VALUES (%(id)s, %(err)s, %(tst)s, %(date)s, %(origin)s, %(Type o)s, %(recip)s, %(Type recip)s)""", d)

db.commit()
db.close()

---

创建我的表的语句：

CREATE TABLE mytable (
      `ID` tinyint unsigned NOT NULL,
      `ERR` tinyint NOT NULL,
      `TST` tinyint unsigned  NOT NULL,
      `DATE` datetime NOT NULL,
     `ORIGIN` varchar(30) NOT NULL,
     `TYPE_O` varchar(10) NOT NULL,
     `RECIP` varchar(30) NOT NULL,
     `TYPE_RECIP` varchar(10) NOT NULL,
     PRIMARY KEY (`ID`,`DATE`)
) ENGINE = InnoDB; 

---

但是我有一个错误，它说：

1064，“您的SQL语法有错误；请查看与您的MySQL服务器版本相对应的手册...）

Answer 1

注意SQL注入，并使用第二个参数execute以插入查询参数：

cursor.execute("""
    INSERT INTO
        table
        (name, age, origin, date)
    VALUES
        (%(name)s, %(age)s, %(origin)s, %(date)s)
""", d)