mysql使用python错误和SQL语法登录

Question

我试图在连接到sql server的python中创建登录脚本，并检查用户输入以查看它是否与sql server匹配，以及是否确实登录了该帐户，但是我在脚本的sql端收到语法错误:)

import MySQLdb

db = MySQLdb.connect(host="localhost",    # your host, usually localhost
                     user="root",         # your username
                     passwd="",  # your password
                     db="login")        # name of the data base

# you must create a Cursor object. It will let
#  you execute all the queries you need
cur = db.cursor()

while (True):
    username = raw_input("Username: ")
    password = raw_input("Password: ")
    if(cur.execute("SELECT * FROM USERS WHERE username =" + username + "AND password =" + password)):
        db.commit()
        print ("Logged in!")
    else:
        db.commit()
        print ("Failed to authenticate!")

Answer 1

您的用户名未与AND运算符分开。 字符串将变为：

SELECT * FROM USERS WHERE username =johnAND password =1234

在用户名和密码值两边加上引号是一个很好的主意：

if(cur.execute("SELECT * FROM USERS WHERE username = \'" + username + "\' AND password = \'" + password + "\'")):

并在来自用户输入并进入SQL查询的每个字符串上使用mysql_escape *函数。

• 我不确定转义语法（\\'）是否适用于python，它是否适用于C，PHP和其他...