Python操作sqlite3快速、安全插入資料（防注入）的執行個體

table通過使用下面語句建立：
複製代碼 代碼如下:

create table userinfo(name text, email text)

更快地插入資料

在此用time.clock()來計時，看看以下三種方法的速度。
複製代碼 代碼如下:

import sqlite3
import time

def create_tables(dbname):
conn = sqlite3.connect(dbname)
cursor = conn.cursor()
cursor.execute('''create table userinfo(name text, email text)''')
conn.commit()
cursor.close()
conn.close()
def drop_tables(dbname):
conn = sqlite3.connect(dbname)
cursor = conn.cursor()
cursor.execute('''drop table userinfo''')
conn.commit()
cursor.close()
conn.close()

def insert1():
users = [('qq','qq@example.com'),
('ww','ww@example.com'),
('ee','ee@example.com'),
('rr','rr@example.com'),
('tt','tt@example.com'),
('yy','yy@example.com'),
('uu','uu@example.com')
]
start = time.clock()
conn = sqlite3.connect(dbname)
cursor = conn.cursor()
for user in users:
cursor.execute("insert into userinfo(name, email) values(?, ?)", user)
conn.commit()
cursor.close()
conn.close()
end = time.clock()
print start, end, end-start

def insert2():
users = [('qq','qq@example.com'),
('ww','ww@example.com'),
('ee','ee@example.com'),
('rr','rr@example.com'),
('tt','tt@example.com'),
('yy','yy@example.com'),
('uu','uu@example.com')
]
start = time.clock()
conn = sqlite3.connect(dbname)
cursor = conn.cursor()
for user in users:
cursor.execute("insert into userinfo(name, email) values(?, ?)", user)
conn.commit()
cursor.close()
conn.close()
end = time.clock()
print start, end, end-start

def insert3():
users = [('qq','qq@example.com'),
('ww','ww@example.com'),
('ee','ee@example.com'),
('rr','rr@example.com'),
('tt','tt@example.com'),
('yy','yy@example.com'),
('uu','uu@example.com')
]
start = time.clock()
conn = sqlite3.connect(dbname)
cursor = conn.cursor()
cursor.executemany("insert into userinfo(name, email) values(?, ?)", users)
conn.commit()
cursor.close()
conn.close()
end = time.clock()
print start, end, end-start

if __name__ == '__main__':
dbname = 'test.db'
create_tables(dbname)
insert1()
drop_tables(dbname)
create_tables(dbname)
insert2()
drop_tables(dbname)
create_tables(dbname)
insert3()
drop_tables(dbname)

某次運行結果：
複製代碼 代碼如下:

4.05223164501e-07 0.531585119557 0.531584714334
0.755963264089 0.867329935942 0.111366671854
1.0324360882 1.12175173111 0.0893156429109

另外一次運行結果：
複製代碼 代碼如下:

4.05223164501e-07 0.565988971446 0.565988566223
0.768132520942 0.843723660494 0.0755911395524
1.04367819446 1.13247636739 0.0887981729298

在運行結果中，第三列表示插入資料使用的時間。綜合看來，方法insert1()的速度很慢，原因在於每次insert都commit()。

更安全地操作資料庫

先上代碼：
複製代碼 代碼如下:

import sqlite3

def create_tables(dbname):
conn = sqlite3.connect(dbname)
cursor = conn.cursor()
cursor.execute('''create table userinfo(name text, email text)''')
conn.commit()
cursor.close()
conn.close()

def drop_tables(dbname):
conn = sqlite3.connect(dbname)
cursor = conn.cursor()
cursor.execute('''drop table userinfo''')
conn.commit()
cursor.close()
conn.close()

def insert():
users = [('qq','qq@example.com'),
('ww','ww@example.com'),
('ee','ee@example.com'),
('rr','rr@example.com'),
('tt','tt@example.com'),
('yy','yy@example.com'),
('uu','uu@example.com')
]
conn = sqlite3.connect(dbname)
cursor = conn.cursor()
cursor.executemany("insert into userinfo(name, email) values(?, ?)", users)
conn.commit()
cursor.close()
conn.close()

def insecure_select(text):
conn = sqlite3.connect(dbname)
cursor = conn.cursor()
print "select name from userinfo where email='%s'" % text
for row in cursor.execute("select name from userinfo where email='%s'" % text):
print row
def secure_select(text):
conn = sqlite3.connect(dbname)
cursor = conn.cursor()
print "select name from userinfo where email='%s'" % text
for row in cursor.execute("select name from userinfo where email= ? ", (text,)):
print row

if __name__ == '__main__':
dbname = 'test.db'
create_tables(dbname)
insert()
insecure_select("uu@example.com")
insecure_select("' or 1=1;--")
secure_select("uu@example.com")
secure_select("' or 1=1;--")
drop_tables(dbname)

運行結果：
複製代碼 代碼如下:

select name from userinfo where email='uu@example.com'
(u'uu',)
select name from userinfo where email='' or 1=1;--'
(u'qq',)
(u'ww',)
(u'ee',)
(u'rr',)
(u'tt',)
(u'yy',)
(u'uu',)
select name from userinfo where email='uu@example.com'
(u'uu',)
select name from userinfo where email='' or 1=1;--'

函數insecure_select(text)和secure_select(text)的本意都是根據email擷取對應的使用者名稱資訊。但是insecure_select(text)的實現容易引起sql注入。

insecure_select("' or 1=1;--")便是一個例子。在insecure_select()中cursor.execute()只有一個參數，即sql語句，這個產生的sql語句如果有問題，還是會照常執行。

secure_select(text)的實現可以防止sql注入，cursor.execute()的第一個參數使用了預留位置?表示要被替代的內容，第二個參數指定每個預留位置對應的值，在底層實現上，這種方法（至少）轉義了特殊字元，可以防止sql注入。

