0

我不确定我的问题是 django、sqlite3、与正则表达式语法的一些奇怪交互，还是只是我：我有一个坏版本的 SQL 查询要由 django.model 正确处理：

qryStrBAD = "SELECT idx, cdate, beat FROM app_database where cc  regexp '^%s'" % (cc)
for c in MyModel.objects.raw(qryStrBAD):

这行得通。但当然我不想允许注入攻击，所以我将它换成了推荐的参数列表版本raw()：

qryStr = "SELECT idx, cdate, beat FROM app_database where cc regexp '^%s'"
for c in MyModel.objects.raw(qryStr,[cc]):

但是使用这个会抛出

DatabaseError at <URL>
Incorrect number of bindings supplied. The current statement uses 0, and there are 1 supplied

更奇怪的是，通过追溯日志戳似乎表明替换正在正确完成：

** .../app/views.py in plotResults

        for c in MyModel.objects.raw(qryStr,[cc]):

    ...

Local vars

qryStr:     "SELECT idx, cdate, beat FROM app_database where cc regexp '^%s'"
cc:             u'LARCENY_THEFT'

** /Library/Python/2.7/site-packages/django/db/models/query.py in __iter__
<RawQuerySet: u"SELECT idx, cdate, beat FROM app_database where cc regexp '^LARCENY_THEFT'">


** /Library/Python/2.7/site-packages/django/db/models/sql/query.py in _execute_query
<RawQuery: u"SELECT idx, cdate, beat FROM app_database where cc regexp '^LARCENY_THEFT'">

** /Library/Python/2.7/site-packages/django/db/backends/util.py in execute
Local vars

params:     [u'LARCENY_THEFT']
sql:            u"SELECT idx, cdate, beat FROM app_database where cc regexp '^LARCENY_THEFT'"


** /Library/Python/2.7/site-packages/django/db/backends/sqlite3/base.py in execute

                six.reraise(utils.DatabaseError, utils.DatabaseError(*tuple(e.args)), sys.exc_info()[2])

    ...


ProgrammingError('Incorrect number of bindings supplied. The current statement uses 0, and there are 1 supplied.',)
Local vars


params:     [u'LARCENY_THEFT']
query:          u"SELECT idx, cdate, beat FROM app_database where cc regexp '^?'"

** /Library/Python/2.7/site-packages/django/db/backends/sqlite3/base.py in execute
Local vars

params:     [u'LARCENY_THEFT']
query:          u"SELECT idx, cdate, beat FROM app_database where cc regexp '^?'"

任何猜测是怎么回事？

4

1 回答 1

0

不要尝试^在查询字符串中与您的参数结合使用。

相反，单独创建正则表达式，然后将其用作参数。

startswith_cc = '^%s' % startswith_cc
qryStr = "SELECT idx, cdate, beat FROM app_database where cc regexp %s"
for c in MyModel.objects.raw(qryStr, [startswith_cc]):
    ...
于 2013-05-16T11:40:33.347 回答