pyodbc - 如何使用参数的变量执行select语句

Question

我试图遍历名为Throughput的表中的所有行,但是对于特定的DeviceName(我已经存储在data ['DeviceName']中.我尝试了以下内容,但它不起作用:

for row in cursor.execute("select * from Throughput where DeviceName=%s"), %(data['DeviceName']):

编辑:也试过这个,但它不起作用:

for row in cursor.execute("select * from Throughput where(DeviceName), values(?)", (data['DeviceName']) ):

EDIT2:我最终工作代码的片段:

query = "select * from Throughput where DeviceName = '%s'" % data['Device Name']
      try:
          for row in cursor.execute(query):

Answer 1

您还可以参数化语句:

...
cursor.execute("select * from Throughput where DeviceName = ?", data['DeviceName'])
...

这是一种更好的方法,原因如下:

• 防止SQL注入(无论是否使用参数化或动态SQL,都应始终验证用户输入)
• 您不必担心使用单引号转义where子句where where,因为参数分别传递给数据库
• SQL准备一次,后续执行的查询使用预准备语句而不是重新编译