pythonmysql防止注入

import mysql.connector

# 连接到数据库
db = mysql.connector.connect(
    host="localhost",
    user="yourusername",
    password="yourpassword",
    database="yourdatabase"
)

cursor = db.cursor()

# 用户输入
username = input("Enter username: ")
password = input("Enter password: ")

# 使用参数化查询防止SQL注入
query = "SELECT * FROM users WHERE username = %s AND password = %s"
cursor.execute(query, (username, password))

result = cursor.fetchall()

for row in result:
    print(row)

from sqlalchemy import create_engine, Column, Integer, String
from sqlalchemy.ext.declarative import declarative_base
from sqlalchemy.orm import sessionmaker

Base = declarative_base()

class User(Base):
    __tablename__ = 'users'
    id = Column(Integer, primary_key=True)
    username = Column(String)
    password = Column(String)

engine = create_engine('mysql+mysqlconnector://yourusername:yourpassword@localhost/yourdatabase')
Base.metadata.create_all(engine)

Session = sessionmaker(bind=engine)
session = Session()

# 用户输入
username = input("Enter username: ")
password = input("Enter password: ")

# 使用ORM防止SQL注入
user = session.query(User).filter_by(username=username, password=password).first()
if user:
    print(user)

query = "SELECT * FROM users WHERE username = '" + username + "' AND password = '" + password + "'"
cursor.execute(query)

query = "SELECT * FROM users WHERE username = %s AND password = %s"
cursor.execute(query, (username, password))