“tuple”对象没有属性“encode”

Question

代码如下（我是Python/Mysql新手）：

import mysql.connector

conn = mysql.connector.connect(host='localhost',user='user1',password='puser1',db='mm')
cursor = conn.cursor()
string1 = 'test1'
insert_query = """INSERT INTO items_basic_info (item_name) VALUES (%s)""", (string1)
cursor.execute(insert_query)
conn.commit()

当我运行此代码时，我收到此错误：

Traceback (most recent call last)
File "test3.py", line 9, in <module>
cursor.execute(insert_query)
File "C:\Users\Emanuele-PC\AppData\Local\Programs\Python\Python36\lib\site-packages\mysql\connector\cursor.py", line 492, in execute
stmt = operation.encode(self._connection.python_charset)
AttributeError: 'tuple' object has no attribute 'encode'

我见过这个问题的不同答案，但情况与我的情况截然不同，我无法真正理解我在哪里犯了错误。谁能帮我？

Answer 1

为了避免 SQL 注入，Django 文档完全推荐使用这样的占位符：

import mysql.connector

conn = mysql.connector.connect(host='localhost',user='user1',password='puser1',db='mm')
cursor = conn.cursor()
string1 = 'test1'
insert_query = """INSERT INTO items_basic_info (item_name) VALUES (%s)"""
cursor.execute(insert_query, (string1,))
conn.commit()

您必须在执行方法中传递元组/列表参数作为第二个参数。一切都应该没问题。