pymysql 使用

一.安裝pyMySQL模塊

pip install pymysql

二,導入須要的模塊

import pymysql

三.構建數據庫屬性

host = 'localhost'
username = 'root'
password = 'root'
db_name = 'test'

四.寫sql語句

insert_table_sql = '''insert into user values (null ,'lw','555222000')'''
find_table_sql = '''select * from user'''
delete_table_sql = '''delete from user where user_id={user_id}'''

五.使用pymysql鏈接數據庫

conn = pymysql.connect(host=host,
                           user=username,
                           password=password,
                           db=db_name)

六.執行SQL語句

try:
        with conn.cursor() as cursor:
            # 插入數據
            # cursor.execute(insert_table_sql.format(username='ll', password='123'))
            # conn.commit()

            # 刪除
            # cursor.execute(delete_table_sql.format(user_id='3'))
            # pymysql刪除數據時,若是,沒有提交,數據庫中數據不變,可是查詢到的東西沒有
            # 要刪除的那條數據
            # conn.commit()
            # 修改數據庫
            cursor.execute(update_table_sql.format(user_id=5))
            # 若是修改沒有提交,在代碼查看到的數據已經修改,單數數據庫中的數據沒有修改
            conn.commit()
            # 查詢所有數據
            cursor.execute(find_table_sql)
            result = cursor.fetchall()
            print(result)

    finally:
        conn.close()

七.防sql注入

修改插入數據sql語句爲:

insert_table_sql = '''insert into user(user_id,user_name,password) values (%S ,%S,%S)'''

執行代碼修改成

cursor.execute(insert_table_sql, (1, 'll', '123'))
 conn.commit()

運行後報錯

Traceback (most recent call last):
  File "D:/creator/pythonProject/0002.py", line 55, in <module>
    save_code()
  File "D:/creator/pythonProject/0002.py", line 33, in save_code
    cursor.execute(insert_table_sql, (1, 'll', '123'))
  File "D:\creator\pythonProject\venv\lib\site-packages\pymysql\cursors.py", line 168, in execute
    query = self.mogrify(query, args)
  File "D:\creator\pythonProject\venv\lib\site-packages\pymysql\cursors.py", line 147, in mogrify
    query = query % self._escape_args(args, conn)
ValueError: unsupported format character 'S' (0x53) at index 54

錯誤緣由:字符佔位符寫錯的應該是%s 而不是$S s應該小寫

修改語句爲

insert_table_sql = '''insert into user(user_id,user_name,password) values (%s ,%s,%s)'''

運行正常