從 SQLite 檢索數據時出現語法錯誤

Question

運行以下代碼時，我得到一個 sqlite3.OperationalError: near XX 錯誤...

代碼在 python 中，如下所示：

def get(item_id='', table='groups', field='id', encrypt=True):
    conn = sqlite3.connect('data.db')
    c = conn.cursor()
    if item_id == '':
        sqlstr = 'SELECT * FROM {}'.format(table)
        c.execute(sqlstr)
    else:
        if encrypt:
            item_id = encryption.encrypt(item_id)
        sqlstr = "SELECT * FROM {} WHERE {}={}".format(table, field, item_id)
        c.execute(sqlstr)

考慮以下變量：

• 表='組'
• 字段 = 'id'
• encrypt = True 並考慮到encryption.encrypt(item_id)返回的值為'gAAAAAABe7UPHni1WJ1pSaljNj30k_SX-xGEfyCNMwO-3Pgjm1I57ROxSq5liNnm8yk5pjv0ZY7SyTUMIYqZrOyLeLQZNZ63iMw=='，我收到以下錯誤：

Traceback (most recent call last):
  File "d:\dhfwi\Projects\FridaysForFuture\fff-transparency-wg\.env\lib\site-packages\telegram\utils\promise.py", line 57, in run
    self._result = self.pooled_function(*self.args, **self.kwargs)
  File "d:\dhfwi\Projects\FridaysForFuture\fff-transparency-wg\fff_automation\bots\telebot\editgroup.py", line 10, in edit_group
    group = database.get(chat_id)[0]
  File "d:\dhfwi\Projects\FridaysForFuture\fff-transparency-wg\fff_automation\modules\database.py", line 149, in get
    c.execute(sqlstr)
sqlite3.OperationalError: near "'gAAAAABe7UPHni1WJ1pSaljNj30k_SX-xGEfyCNMwO-3Pgjm1I57ROxSq5liNnm8yk5pjv0ZY7SyTUMIYqZrOyLeLQZNZ63iMw=='": syntax error

我嘗試在 sqlstr 的 item_id 字段的 {} 周圍添加 ''，

sqlstr = "SELECT * FROM {} WHERE {}='{}'".format(table, field, item_id)

但這樣做，我得到以下錯誤：

Traceback (most recent call last):
  File "d:\dhfwi\Projects\FridaysForFuture\fff-transparency-wg\.env\lib\site-packages\telegram\utils\promise.py", line 57, in run
    self._result = self.pooled_function(*self.args, **self.kwargs)
  File "d:\dhfwi\Projects\FridaysForFuture\fff-transparency-wg\fff_automation\bots\telebot\editgroup.py", line 10, in edit_group
    group = database.get(chat_id)[0]
  File "d:\dhfwi\Projects\FridaysForFuture\fff-transparency-wg\fff_automation\modules\database.py", line 149, in get
    c.execute(sqlstr)
sqlite3.OperationalError: near "gAAAAABe7Ue7Yg6OP2ipWHGAXfZCiCVgbpdPso3noPYCjW4ds9rY8Yg9HN0Dhm10DDh7wYQ3kf2OuSabHlxcrg5xzwEdO4V31Q": syntax error

Answer 1

考慮將item_id作為帶有 qmark 占位符的參數傳遞，因為引用混淆可能是問題：

sqlstr = "SELECT * FROM {} WHERE {}=?".format(table, field)
# sqlstr = f"SELECT * FROM {table} WHERE {field}=?"    # F-String (Python 3.6+)

c.execute(sqlstr, (item,))