SQL injection in Python

Connect database operations before Charu

#Coding:utf-8 fromPymysqlImportConnect#connecting to a databaseconn=Connect (Host='localhost', Port= 3306, the user='Root', passwd='Root', DB='CA',        )#Create an action cursor and create an action link for MySQLA=conn.cursor ()#set the character set to Utf-8A.execute ('Set names UTF8') method One format mode SQL='INSERT INTO TB1 (Name,age,phone) VALUES ({0},{1},{2})'. Format ("7", 54,"1566456465") a.execute (SQL)

Method One
Format mode
Sql= ' INSERT into TB1 (Name,age,phone) VALUES ({0},{1},{2}) '. Format ("7", 54, "1566456465")
A.execute (SQL)

Method Two
The original replacement
Sql= ' INSERT into TB1 (Name,age,phone) VALUES (%s,%s,%s) '% ("7", "54", "1555566")
A.execute (SQL)

Method Three
Using the Execute
Sql= ' INSERT into TB1 (Name,age,phone) VALUES (%s,%s,%s) '
Parm= (7,54,1566456465)
A.execute (Sql,parm)

Note that in the Execute function, the amount of changes in SQL is replaced with parm strings

SQL injection in Python