来自变量的类似 SQL 语句 [英] Sql statement with like from variable

问题描述

我在 python 中执行这段代码

I'm executing this code in python

from sqlite3 import dbapi2 as sqlite

con = sqlite.connect("db.sqlite")
cur = con.cursor()
surname = "'%atton%'"
cur.execute("select id from singers where surname like :surname", locals())
cur.close()
con.close()

在这段代码之后 cur.rowcount == -1 但 Patton 在数据库中.

After this code cur.rowcount == -1 but Patton is in the database.

我的 SQL 语句不好吗?

Is my SQL statement bad?

谢谢

推荐答案

您使用的 DB-API 参数化(您应该使用，不要更改)意味着姓氏将被自动引用或适当地逃脱.您应该从 surname 字符串中删除内部引号集.

The DB-API parameterization you use (which you should use, don't change that) means the surname will automatically be quoted or escaped appropriately. You should remove the inner set of quotes from your surname string.

surname = "%atton%"
cur.execute("select id from singers where surname like :surname",
    dict(surname=surname))

这篇关于来自变量的类似 SQL 语句的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！