多条件查询语句,避免sql拼接引起sql注入写法

来源:互联网 发布:linux删除用户组和用户 编辑:程序博客网 时间:2024/06/08 16:55
para_count =  (name,name,usertype,usertype)sql_count = """ select count(*) as counts from users where v_account_type !='tequia'             AND (%s is NULL or v_username = %s)             AND (%s is NULL or v_account_type = %s)"""
cursor = g.cursorcursor.execute(sql, para)

参考http://www.cnblogs.com/yucaiyun/p/7101723.html