python - 当尝试在参数化 SQL 查询中使用字符串时，为什么会收到 "TypeError: not all arguments converted during string formatting"？

Question

我有这个代码:

#! /usr/bin/env python
import MySQLdb as mdb
import sys    

class Test:
    def check(self, search):
        try:
            con = mdb.connect('localhost', 'root', 'password', 'recordsdb');
            cur = con.cursor()
            cur.execute( "SELECT * FROM records WHERE email LIKE '%s'", search )
            ver = cur.fetchone()            
            print "Output : %s " % ver            
        except mdb.Error, e:          
            print "Error %d: %s" % (e.args[0],e.args[1])
            sys.exit(1)            
        finally:    
            if con:    
                con.close()

test = Test()
test.check("test")

但我收到如下错误:

Traceback (most recent call last):
  File "./lookup", line 27, in <module>
    test.check("test")
  File "./lookup", line 11, in creep
    cur.execute( "SELECT * FROM records WHERE email LIKE '%s'", search )
  File "/usr/local/lib/python2.7/dist-packages/MySQLdb/cursors.py", line 187, in execute
    query = query % tuple([db.literal(item) for item in args])
TypeError: not all arguments converted during string formatting

出了什么问题，如何解决？

<小时/>

_{sqlitem中出现同样的问题，报告不同；请参阅sqlite3.ProgrammingError: Incorrect number of bindings supplied. The current statement uses 1, and there are 74 supplied了解详情。}

Answer 1

而不是这个:

cur.execute( "SELECT * FROM records WHERE email LIKE '%s'", search )

试试这个:

cur.execute( "SELECT * FROM records WHERE email LIKE %s", [search] )

查看 MySQLdb documentation 。原因是 execute 的第二个参数表示要转换的对象列表，因为参数化查询中可以有任意数量的对象。在这种情况下，您只有一个，但它仍然需要是一个可迭代的(元组而不是列表也可以)。