sql注入之采用手动拼接的情况
import pymysql
conn = pymysql.connect(
user='root',
password='zx360828htc',
host='localhost',
port=3306,
charset='utf8',
database='test'
)
cursor = conn.cursor(cursor=pymysql.cursors.DictCursor)
movieid = input('username>>').strip()
moviename = input('password>>').strip()
sql = "select * from movie where movieid = '%s' and moviename = '%s'" % (movieid, moviename)
# sql = 'select * from user_info where name = "%s" and password = "%s"' % (username, password)
# select * from user_info where name = "张三' -- fhjkasdhfkla" and password = "" 外层使用单引号出不来效果
print(sql)
cursor.execute(sql)
res = cursor.fetchall()
if res:
print(res)
else:
print('username or password error!')
