2019-02-14
閱讀量:
1076
執(zhí)行raw sql時(shí)如何防止sql注入
問(wèn)題描述:
mysqldb,sqlalchemy和flask-sqlalchemy執(zhí)行raw sql時(shí)如何防止sql注入
解決方法:
mysqldb
c=db.cursor()
max_price=5
c.execute("""SELECT spam, eggs, sausage FROM breakfast
WHERE price < %s""", [max_price])
sqlalchemy
from sqlalchemy.sql import text
t = text("select * from test where id= :tid")
conn.execute(t, tid=1).fetchall()
flask-sqlalchemy
db = SQLAlchemy(app)
conn = db.session.connection()
@app.route('/')
def index():
rv = conn.execute('select * from test where id = %s', [1])
return jsonify(rv)






評(píng)論(0)


暫無(wú)數(shù)據(jù)
CDA考試動(dòng)態(tài)
CDA報(bào)考指南
推薦帖子
0條評(píng)論
0條評(píng)論
0條評(píng)論
1條評(píng)論