Python - 我的MySQL查询中的错误在哪里？

Question

我正在使用PyMySQL和Python。

sql = "INSERT INTO accounts(date_string, d_day, d_month, d_year, trans_type, descriptor, inputs, outputs, balance, owner) VALUES ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', AES_ENCRYPT('%s', 'example_key_str')" 
cur.execute(sql % (date, d_day, d_month, d_year, ttype, desc, money_in, money_out, bal, owner)) 

这引发了模糊的语法错误，我不知道如何解决它。该评估查询：

INSERT INTO accounts(date_string, d_day, d_month, d_year, trans_type, descriptor, inputs, outputs, balance, owner) VALUES ('12 Feb 2012', '12', 'Feb', '2012', 'CHQ', 'CHQ 54', '7143.78', '0.00', '10853.96', AES_ENCRYPT('test@example.com', 'example_key_str') 

MySQL的错误是：

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 

任何帮助将非常感激。提前致谢。

Answer 1

没有右括号：

INSERT INTO 
    accounts 
    (date_string, d_day, d_month, d_year, 
    trans_type, descriptor, inputs, outputs, balance, 
    owner) 
VALUES 
    ('12 Feb 2012', '12', 'Feb', '2012', 
    'CHQ', 'CHQ 54', '7143.78', '0.00', '10853.96',   
    AES_ENCRYPT('test@example.com', 'example_key_str')) 
                HERE^ 

作为一个侧面说明，不要使用字符串格式化的查询参数插入查询 - 有一个更安全，更便捷的方式来做到这一点 - 参数化查询：

sql = """ 
    INSERT INTO 
     accounts 
     (date_string, d_day, d_month, d_year, 
     trans_type, descriptor, inputs, outputs, balance, 
     owner) 
    VALUES 
     (%s, %s, %s, %s, 
     %s, %s, %s, %s, %s, 
     AES_ENCRYPT(%s, 'example_key_str'))""" 
cur.execute(sql, (date, d_day, d_month, d_year, ttype, desc, money_in, money_out, bal, owner))