python - 如何在 Django Python 中的原始 SQL 中插入参数

Question

我有这个代码

myquery =   '''SELECT * from users 
               where id = 10 and
               city = 20 and 
               state = 30'''

我想用三个变量替换那些

var_id = bla
var_city = bla
var_state = bla

Answer 1

使用 params argument to raw() :

var_id = 10
var_city = 20
var_state = 30

mymodel.objects.raw('''SELECT * from users 
                       where id = %s and
                       city = %s and 
                       state = %s ''', [var_id, var_city, var_state])

params 是参数列表。您将在查询字符串中使用 %s 占位符(无论您的数据库引擎如何)；它们将被 params 列表中的参数替换。

---

来自 Django 文档的重要说明:

Warning Do not use string formatting on raw queries!

It's tempting to write the above query as:

>>> query = 'SELECT * FROM myapp_person WHERE last_name = %s' % lname
>>> Person.objects.raw(query)

Don't.

Using the params list completely protects you from SQL injection attacks, a common exploit where attackers inject arbitrary SQL into your database. If you use string interpolation, sooner or later you'll fall victim to SQL injection. As long as you remember to always use the params list you'll be protected.