Python网页版如何防止SQL注入_Python网页版SQL注入防护与安全编码方法

import sqlite3
<p>conn = sqlite3.connect("example.db")
cursor = conn.cursor()</p><h1>正确方式：使用参数化</h1><p>username = input("请输入用户名：")
cursor.execute("SELECT * FROM users WHERE username = ?", (username,))</p><h1>错误方式：字符串拼接（危险！）</h1><h1>cursor.execute(f"SELECT * FROM users WHERE username = '{username}'")</h1>

import mysql.connector
<p>conn = mysql.connector.connect(user='root', password='pwd', database='test')
cursor = conn.cursor()</p><h1>使用 %s 占位符</h1><p>cursor.execute("SELECT * FROM users WHERE email = %s", (email,))</p>

from sqlalchemy.orm import sessionmaker
from models import User  # 假设已定义User模型
<p>Session = sessionmaker(bind=engine)
session = Session()</p><h1>安全查询，不会产生SQL注入</h1><p>user = session.query(User).filter(User.username == username).first()</p>

import re
<p>def is_valid<em>username(username):
return re.match(r"^[a-zA-Z0-9</em>]{3,30}$", username) is not None</p>