如何在python中存储postgres的单引号[重复]

Question

{
"status": 2,
"records": 1,
"message": "OK",
"id": "131",
"name": "SUPA'AT",
"address": "RUNGKUT SA'GIRI"
}

我的python代码：

sql = "UPDATE my_data SET name='"+str(response["name"])+"', address='"+str(response["address"])+"' WHERE id='"+id+"'"
cursor.execute(sql)
conn.commit()  

Answer 1

请执行以下操作：

sql = "UPDATE my_data SET name = %s, address = %s WHERE id = %s"
cursor.execute(sql, response["name"], response["address"], id)
conn.commit()  

假设您以前在某个地方分配了ID。

您共享的代码是SQL代码注入的噩梦，正如@packetloss在注释中所指出的，并在https://owasp.org/www-community/attacks/sql_inject上解释了这一点