我正在尝试用python执行一个动态sql查询。它看起来像下面
import json
from decimal import Decimal
import psycopg2
def initial_execution(param_name):
time = get_timestamp(param_name)
query = 'SELECT name, account_mgr, addr1, addr2, ap_email, bill_to_nbr, billto_only, city, controlling_nbr, controlling_only, country, cust_contact, email, load_create_date, load_update_date, nbr, owner, sales_rep, source_system, state, station, zip FROM public.customers WHERE billto_only = 'Y' OR controlling_only = 'Y' AND load_create_date >= \''+time+'\' OR load_update_date >= \''+time+'\''
queryData = execute_db_query(query)
执行\u db\u查询->;此函数使用pscopg2以红移方式运行 我通过从用户输入中动态提取“时间”来执行此脚本。我犯了一个错误
[ERROR] Runtime.UserCodeSyntaxError: Syntax error in module
'src/customers':
invalid syntax (customers.py, line 78)
Traceback
(most recent call last): File "/var/task/src/customers.py"
Line 78 query = 'SELECT name,billto_only, controlling_only , load_create_date, load_update_date, nbr, owner, sales_rep,
source_system, state, station, zip FROM public.test WHERE billto_only
= 'Y' OR controlling_only = 'Y' AND load_create_date >= \''+time+'\' OR load_update_date >= \''+time+'\''
sql中的相同查询如下所示编写并正确执行
SELECT name,billto_only, controlling_only,load_create_date, load_update_date, nbr, owner, sales_rep, source_system, state, station, zip FROM public.test
WHERE (billto_only = 'Y' OR controlling_only = 'Y') AND (load_create_date >= '2020-10-09 07:04:51' OR load_update_date >= '2020-10-09 07:04:51') limit 5;
发生错误的原因是
'
符号可能有点不对劲,但“Y”会打断你的弦吗
省略撇号
正确的方法是:
以上内容确保传入的数据正确引用,并防止SQL注入问题。 我还避免使用变量名,如
time
。这与Postgres中的time
模块以及time
类型存在潜在冲突相关问题 更多 >
编程相关推荐