由网友(一颗心、你看着伤°)分享简介：这是我的脚本：import mysql.connectordef loginsystem():db = mysql.connector.connect(host="127.0.0.1",user="root",passwd="",db="dbpython")cursor = db.cursor()loop = 'tr...

这是我的脚本：

import mysql.connector
def loginsystem():
    db = mysql.connector.connect(host="127.0.0.1",
                                 user="root",
                                 passwd="",
                                 db="dbpython")

    cursor = db.cursor()

    loop = 'true'
    while (loop == 'true'):
        username = str(input("Username : "))
        password = str(input("Password : "))

        if (cursor.execute("SELECT * FROM users WHERE username = %s AND password = %s"%(username,password))):

            print("Logged İn")
        else:
            print("Failure")
    db.commit()
loginsystem()

我正在安装一个在线系统，但我遇到了登录系统问题。如何修复"WHERE子句中的未知列‘x’"或您有任何其他代码建议吗？

if (cursor.execute("SELECT * FROM users WHERE (username =?  password = ?) VALUES(?,?)"(username,password))):

我尝试过使用此方法，但没有成功

Traceback (most recent call last):
  File "C:/Users/artun/PycharmProjects/DENEMELER/Login System.py", line 21, in <module>
    loginsystem()
  File "C:/Users/artun/PycharmProjects/DENEMELER/Login System.py", line 15, in loginsystem
    if (cursor.execute("SELECT * FROM users WHERE username = %s AND password = %s"%(username,password))):
  File "C:UsersartunPycharmProjectsDENEMELERvenvlibsite-packagesmysqlconnectorcursor.py", line 569, in execute
    self._handle_result(self._connection.cmd_query(stmt))
  File "C:UsersartunPycharmProjectsDENEMELERvenvlibsite-packagesmysqlconnectorconnection.py", line 553, in cmd_query
    result = self._handle_result(self._send_cmd(ServerCmd.QUERY, query))
  File "C:UsersartunPycharmProjectsDENEMELERvenvlibsite-packagesmysqlconnectorconnection.py", line 442, in _handle_result
    raise errors.get_exception(packet)
mysql.connector.errors.ProgrammingError: 1054 (42S22): Unknown column 'oziboran123' in 'where clause'

Process finished with exit code 1

这是代码的输出，但我预计代码的输出将是"已登录"或"失败"

推荐答案

考虑参数化，而不是字符串内插，后者涉及两步过程，即准备好的语句，然后执行绑定参数。下面使用了执行调用的两个参数：cursor.execute(query, params)。此外，用户和密码在MySQL中为reserved words，应使用反号进行转义。

请注意，mysql.connectorAPI的参数占位符%s不要与Python的模字符串格式符号混淆(顺便说一句，在Python中preferred string formatting method越少，str.format越好)。

# PREPARED STATEMENT
sql = """SELECT * FROM `users`
         WHERE `username` = %s AND `password` =%s
      """

# EXECUTE WITH PARAMS
cursor.execute(sql, (username, password))