从 SQLite 检索数据时出现语法错误

Question

运行以下代码时，我得到一个 sqlite3.OperationalError: near XX 错误...

代码在 python 中，如下所示：

def get(item_id='', table='groups', field='id', encrypt=True):
    conn = sqlite3.connect('data.db')
    c = conn.cursor()
    if item_id == '':
        sqlstr = 'SELECT * FROM {}'.format(table)
        c.execute(sqlstr)
    else:
        if encrypt:
            item_id = encryption.encrypt(item_id)
        sqlstr = "SELECT * FROM {} WHERE {}={}".format(table, field, item_id)
        c.execute(sqlstr)

考虑以下变量：

• 表='组'
• 字段 = 'id'
• encrypt = True 并考虑到encryption.encrypt(item_id)返回的值为'gAAAAAABe7UPHni1WJ1pSaljNj30k_SX-xGEfyCNMwO-3Pgjm1I57ROxSq5liNnm8yk5pjv0ZY7SyTUMIYqZrOyLeLQZNZ63iMw=='，我收到以下错误：

Traceback (most recent call last):
  File "d:\dhfwi\Projects\FridaysForFuture\fff-transparency-wg\.env\lib\site-packages\telegram\utils\promise.py", line 57, in run
    self._result = self.pooled_function(*self.args, **self.kwargs)
  File "d:\dhfwi\Projects\FridaysForFuture\fff-transparency-wg\fff_automation\bots\telebot\editgroup.py", line 10, in edit_group
    group = database.get(chat_id)[0]
  File "d:\dhfwi\Projects\FridaysForFuture\fff-transparency-wg\fff_automation\modules\database.py", line 149, in get
    c.execute(sqlstr)
sqlite3.OperationalError: near "'gAAAAABe7UPHni1WJ1pSaljNj30k_SX-xGEfyCNMwO-3Pgjm1I57ROxSq5liNnm8yk5pjv0ZY7SyTUMIYqZrOyLeLQZNZ63iMw=='": syntax error

我尝试在 sqlstr 的 item_id 字段的 {} 周围添加 ''，

sqlstr = "SELECT * FROM {} WHERE {}='{}'".format(table, field, item_id)

但这样做，我得到以下错误：

Traceback (most recent call last):
  File "d:\dhfwi\Projects\FridaysForFuture\fff-transparency-wg\.env\lib\site-packages\telegram\utils\promise.py", line 57, in run
    self._result = self.pooled_function(*self.args, **self.kwargs)
  File "d:\dhfwi\Projects\FridaysForFuture\fff-transparency-wg\fff_automation\bots\telebot\editgroup.py", line 10, in edit_group
    group = database.get(chat_id)[0]
  File "d:\dhfwi\Projects\FridaysForFuture\fff-transparency-wg\fff_automation\modules\database.py", line 149, in get
    c.execute(sqlstr)
sqlite3.OperationalError: near "gAAAAABe7Ue7Yg6OP2ipWHGAXfZCiCVgbpdPso3noPYCjW4ds9rY8Yg9HN0Dhm10DDh7wYQ3kf2OuSabHlxcrg5xzwEdO4V31Q": syntax error

Answer 1

考虑将item_id作为带有 qmark 占位符的参数传递，因为引用混淆可能是问题：

sqlstr = "SELECT * FROM {} WHERE {}=?".format(table, field)
# sqlstr = f"SELECT * FROM {table} WHERE {field}=?"    # F-String (Python 3.6+)

c.execute(sqlstr, (item,))