Question

我在plpgsql函数的insert值中使用单引号时遇到问题它看起来像这样：

“AND（u.firstname LIKE'koen'）或（u.firstname LIKE'dirk'）“

这是通过python

完成的

我试过''和''和''''''''和'''''甚至'''''''' 它们似乎都没有工作并返回以下错误：

[FAIL] [语法错误在“koen”或附近第1行：......'u.firstname'，'ASC'，'AND（u.firstname LIKE'koe ......

感谢任何帮助！

非常感谢！

========================编辑====================== ===

抱歉！这是我的plpgsql函数：

CREATE FUNCTION get_members(IN in_company_uuid uuid, IN in_start integer, IN in_limit integer, IN in_sort character varying, IN in_order character varying, IN in_querystring CHARACTER VARYING, IN in_filterstring CHARACTER VARYING, IN OUT out_status integer, OUT out_status_description character varying, OUT out_value character varying[]) RETURNS record
    LANGUAGE plpgsql
    AS $$DECLARE

temp_record RECORD;
temp_out_value VARCHAR[];
--temp_member_struct MEMBER_STRUCT;
temp_iterator INTEGER := 0;

BEGIN

FOR temp_record IN EXECUTE '
SELECT DISTINCT ON
    (' || in_sort || ')
    u.user_uuid,
    u.firstname,
    u.preposition,
    u.lastname,
    array_to_string_ex(ARRAY(SELECT email FROM emails WHERE user_uuid = u.user_uuid)) as emails,
    array_to_string_ex(ARRAY(SELECT mobilenumber FROM mobilenumbers WHERE user_uuid = u.user_uuid)) as mobilenumbers,
    array_to_string_ex(ARRAY(SELECT c.name FROM targetgroupusers AS tgu LEFT JOIN membercategories as mc ON mc.targetgroup_uuid = tgu.targetgroup_uuid LEFT JOIN categories AS c ON mc.category_uuid = c.category_uuid WHERE tgu.user_uuid = u.user_uuid)) as categories,
    array_to_string_ex(ARRAY(SELECT color FROM membercategories WHERE targetgroup_uuid IN(SELECT targetgroup_uuid FROM targetgroupusers WHERE user_uuid = u.user_uuid))) as colors
FROM
    membercategories AS mc
LEFT JOIN
    targetgroups AS tg
ON
    tg.targetgroup_uuid = mc.targetgroup_uuid
LEFT JOIN
    targetgroupusers AS tgu
ON
    tgu.targetgroup_uuid = tg.targetgroup_uuid
LEFT JOIN
    users AS u
ON
    u.user_uuid = tgu.user_uuid
WHERE
    mc.company_uuid = ''' || in_company_uuid || '''
    ' || in_querystring || '
    ' || in_filterstring || '
ORDER BY
   ' || in_sort || ' ' || in_order || '
OFFSET
    ' || in_start || '
LIMIT
    ' || in_limit

LOOP
 temp_out_value[temp_iterator] = ARRAY[temp_record.user_uuid::VARCHAR(36),
                                       temp_record.firstname,
                                       temp_record.preposition,
                                       temp_record.lastname,
                                       temp_record.emails,
                                       temp_record.mobilenumbers,
                                       temp_record.categories,
                                       temp_record.colors];
 temp_iterator = temp_iterator+1;
END LOOP;

out_status := 0;
out_status_description := 'Members retrieved';
out_value := temp_out_value;

RETURN;

END$$;

以下是我如何调用该函数：

def get_members(companyuuid, start, limit, sort, order, querystring = None, filterstring = None):
    logRequest()
    def doWork(cursor):        
        if not companyuuid:
            raise Exception("companyuuid cannot be None!")   

        queryarray = [str(s) for s in querystring.split("|")]        
        queryfields = ['firstname', 'preposition', 'lastname', 'emails', 'mobilenumbers']

        temp_querystring = ""
        for j in xrange(len(queryfields)):
            for i in xrange(len(queryarray)):
                temp_querystring += "(u.%s LIKE ''%%%s%'') OR "%(queryfields[j], queryarray[i])

        temp_querystring = "AND %s"%temp_querystring.rstrip(" OR ")
        temp_filterstring = filterstring
        print "querystring: %s"%temp_querystring

        heizoodb.call(cursor=cursor,
                      scheme="public", 
                      function="get_members", 
                      functionArgs=(companyuuid, start, limit, sort, order, temp_querystring, temp_filterstring),
                      returnsValue=True)

我的最新错误= D

com.gravityzoo.core.libs.sql.PostgreSQLDB.runSQLTransaction：格式字符串的参数不够，结果= [无]

稍后要添加的SQLinjection;）

谢谢！

Answer 1

我不太了解Python，但它可能支持数据绑定，您首先准备一个语句（并且您不需要在那里附带问号的引号）：

prepare("..... AND (u.firstname LIKE ?) OR (u.firstname LIKE ?)")

然后你调用执行（'koen'，'dirk'）或者在Python中调用该函数。

PLPGSQL在函数调用中使用单引号（python）

1 个答案: