【发布时间】：2015-04-13 10:13:42
【问题描述】：
我正在尝试在 MySQL 中进行 INSERT：
insert = "INSERT INTO newspapers (title , description, newspaper, updated) VALUES ('{0}','{1}','{2}','{3}')".format(
str(title), str(description), str(id), str(updated))
我收到此错误：
INSERT INTO newspapers (title , description, newspaper, updated) VALUES ('b'Bonomi: polic\xc3\xadas "entregan" casas de Carrasco y Punta Gorda a delincuentes'','b'Robaron en el domicilio del Jefe de Polic\xc3\xada de Montevideo, Mario Layera, y tambi\xc3\xa9n quisieron ingresar al del subsecretario de Interior, Jorge V\xc3\xa1zquez'','1','2015-02-12 13:34:43.843586')
Traceback (most recent call last):
File "/Users/user/Desarrollo/news/parser.py", line 85, in <module>
cur.execute(insert)
File "/Library/Frameworks/Python.framework/Versions/3.4/lib/python3.4/site-packages/pymysql/cursors.py", line 135, in execute
result = self._query(query)
File "/Library/Frameworks/Python.framework/Versions/3.4/lib/python3.4/site-packages/pymysql/cursors.py", line 274, in _query
conn.query(q)
File "/Library/Frameworks/Python.framework/Versions/3.4/lib/python3.4/site-packages/pymysql/connections.py", line 714, in query
self._affected_rows = self._read_query_result(unbuffered=unbuffered)
File "/Library/Frameworks/Python.framework/Versions/3.4/lib/python3.4/site-packages/pymysql/connections.py", line 865, in _read_query_result
result.read()
File "/Library/Frameworks/Python.framework/Versions/3.4/lib/python3.4/site-packages/pymysql/connections.py", line 1062, in read
first_packet = self.connection._read_packet()
File "/Library/Frameworks/Python.framework/Versions/3.4/lib/python3.4/site-packages/pymysql/connections.py", line 830, in _read_packet
packet.check_error()
File "/Library/Frameworks/Python.framework/Versions/3.4/lib/python3.4/site-packages/pymysql/connections.py", line 348, in check_error
raise_mysql_exception(self._data)
File "/Library/Frameworks/Python.framework/Versions/3.4/lib/python3.4/site-packages/pymysql/err.py", line 116, in raise_mysql_exception
_check_mysql_exception(errinfo)
File "/Library/Frameworks/Python.framework/Versions/3.4/lib/python3.4/site-packages/pymysql/err.py", line 109, in _check_mysql_exception
raise errorclass(errno,errorvalue)
pymysql.err.ProgrammingError: (1064, 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near \'Bonomi: polic\\xc3\\xadas "entregan" casas de Carrasco y Punta Gorda a delincuente\' at line 1')
【问题讨论】：
-
部分错误信息丢失。可以加一下吗？
-
你为什么不使用参数化查询？
-
你切断了整个错误信息。你能发布整个消息吗？此外，替换值的 SQL 字符串是否在您的程序之外工作，或者您是否收到相同的错误消息。
-
检查您的任何变量中是否有单引号字符
-
您需要在您插入的字符串中转义特殊字符——例如刻度线等。在 SQL Injection 上搜索一些关于处理此类事情的方便指针。