mysql中如何防止sql注入

import mysql.connector

# 连接到数据库
db = mysql.connector.connect(
    host="localhost",
    user="yourusername",
    password="yourpassword",
    database="yourdatabase"
)

# 创建游标
cursor = db.cursor()

# 使用参数化查询
query = "SELECT * FROM users WHERE username = %s AND password = %s"
values = ("admin", "password123")

cursor.execute(query, values)

# 获取结果
results = cursor.fetchall()

# 关闭连接
cursor.close()
db.close()

DELIMITER //

CREATE PROCEDURE GetUserByUsernameAndPassword(IN username VARCHAR(255), IN password VARCHAR(255))
BEGIN
    SELECT * FROM users WHERE username = username AND password = password;
END //

DELIMITER ;

import mysql.connector

# 连接到数据库
db = mysql.connector.connect(
    host="localhost",
    user="yourusername",
    password="yourpassword",
    database="yourdatabase"
)

# 创建游标
cursor = db.cursor()

# 调用存储过程
cursor.callproc('GetUserByUsernameAndPassword', ('admin', 'password123'))

# 获取结果
for result in cursor.stored_results():
    results = result.fetchall()

# 关闭连接
cursor.close()
db.close()

from django.db import models

class User(models.Model):
    username = models.CharField(max_length=255)
    password = models.CharField(max_length=255)

# 查询用户
users = User.objects.filter(username='admin', password='password123')