query -- string, query to execute on server
args -- optional sequence or mapping, parameters to use with query.

Note: If args is a sequence, then %s must be used as the
parameter placeholder in the query. If a mapping is used,
%(key)s must be used as the placeholder.

mysql> select * from testdb.person;
+------+--------+
| id   | name   |
+------+--------+
|    1 | foo    |
|    2 | bar    |
+------+--------+

import MySQLdb


def select(name):
    connection = MySQLdb.connect(db='testdb', user='testuser')
    cursor = connection.cursor()
    cursor.execute("select * from person where name='%s'" % name)
    print("[query]")
    print(cursor._last_executed)
    print("[result]")
    result = cursor.fetchall()
    for rec in result:
        print(rec)

[query]
select * from person where name='foo'
[result]
(1L, 'foo')

[query]
select * from person where name='foo' or name=name-- '
[result]
(1L, 'foo')
(2L, 'bar')

import MySQLdb


def select(name):
    connection = MySQLdb.connect(db='testdb', user='testuser')
    cursor = connection.cursor()
    cursor.execute("select * from person where name=%s", name)
    print("[query]")
    print(cursor._last_executed)
    print("[result]")
    result = cursor.fetchall()
    for rec in result:
        print(rec)

[query]
select * from person where name='foo'
[result]
(1L, 'foo')

[query]
select * from person where name='foo\' or name=name-- '
[result]

Recommended Posts