mysql.connector.errors.ProgrammingError: 1054 (42S22)：“where子句”中未知列“X”

Question

这是我的剧本：

import mysql.connector
def loginsystem():
    db = mysql.connector.connect(host="127.0.0.1",
                                 user="root",
                                 passwd="",
                                 db="dbpython")

    cursor = db.cursor()

    loop = 'true'
    while (loop == 'true'):
        username = str(input("Username : "))
        password = str(input("Password : "))

        if (cursor.execute("SELECT * FROM users WHERE username = %s AND password = %s"%(username,password))):

            print("Logged İn")
        else:
            print("Failure")
    db.commit()
loginsystem()

我正在安装一个在线系统，但我遇到了一个问题的登录系统。如何在where子句中修正“未知列'x‘”，或者您有其他代码建议吗？

if (cursor.execute("SELECT * FROM users WHERE (username =?  password = ?) VALUES(?,?)"(username,password))):

我试着用这种方法做，但没有

Traceback (most recent call last):
  File "C:/Users/artun/PycharmProjects/DENEMELER/Login System.py", line 21, in <module>
    loginsystem()
  File "C:/Users/artun/PycharmProjects/DENEMELER/Login System.py", line 15, in loginsystem
    if (cursor.execute("SELECT * FROM users WHERE username = %s AND password = %s"%(username,password))):
  File "C:\Users\artun\PycharmProjects\DENEMELER\venv\lib\site-packages\mysql\connector\cursor.py", line 569, in execute
    self._handle_result(self._connection.cmd_query(stmt))
  File "C:\Users\artun\PycharmProjects\DENEMELER\venv\lib\site-packages\mysql\connector\connection.py", line 553, in cmd_query
    result = self._handle_result(self._send_cmd(ServerCmd.QUERY, query))
  File "C:\Users\artun\PycharmProjects\DENEMELER\venv\lib\site-packages\mysql\connector\connection.py", line 442, in _handle_result
    raise errors.get_exception(packet)
mysql.connector.errors.ProgrammingError: 1054 (42S22): Unknown column 'oziboran123' in 'where clause'

Process finished with exit code 1

这是代码的输出，但我希望代码的输出是“登录”或“失败”。

Answer 1

考虑参数化而不是字符串插值，这涉及准备语句的两步过程，然后执行绑定参数。下面使用了执行调用的两个参数：cursor.execute(query, params)。另外，用户和密码都是保留字中的MySQL，应该用倒扣来转义。

请注意参数占位符%s，因为Python不应该与mysql.connector的模块化字符串格式符号(顺便说一句，它是首选字符串格式方法中更多首选的str.format)混淆。

# PREPARED STATEMENT
sql = """SELECT * FROM `users`
         WHERE `username` = %s AND `password` =%s
      """

# EXECUTE WITH PARAMS
cursor.execute(sql, (username, password))

Answer 2

试试下面的代码：

 """SELECT * FROM `users` WHERE `username` '{}' AND `password` '{}'""".format(username,password))