c=db.cursor()
max_price=5
c.execute("""SELECT spam, eggs, sausage FROM breakfast
WHERE price < %s""", (max_price,))
</div>
注意，上面的SQL字符串与后面的tuple之间的分隔符是逗号，平时拼写SQL用的是%。
如果按照以下写法，是容易产生SQL注入的：
c.execute("""SELECT spam, eggs, sausage FROM breakfast
WHERE price < %s""" % (max_price,))
</div>
这个和PHP里的PDO是类似的，原理同MySQL Prepared Statements。
Python
Using the Python DB API, don't do this:
# Do NOT do it this way.
cmd = "update people set name='%s' where id='%s'" % (name, id) curs.execute(cmd)
</div>
Instead, do this:
cmd = "update people set name=%s where id=%s" curs.execute(cmd, (name, id))
</div>
Note that the placeholder syntax depends on the database you are using.
The values for the most common databases are:
>>> import MySQLdb; print MySQLdb.paramstyle format >>> import psycopg2; print psycopg2.paramstyle pyformat >>> import sqlite3; print sqlite3.paramstyle qmark
</div>
So if you are using MySQL or PostgreSQL, use %s (even for numbers and other non-string values!) and if you are using SQLite use ?