问题
Does MySQLdb support server-side prepared statements? I can't figure this out from its manual.
回答1:
Check the MySQLdb Package Comments:
"Parameterization" is done in MySQLdb by escaping strings and then blindly interpolating them into the query, instead of using the MYSQL_STMT API. As a result unicode strings have to go through two intermediate representations (encoded string, escaped encoded string) before they're received by the database.
So the answer is: No, it doesn't.
回答2:
It has some kind of parameterization, yes.
Even then, I advise you switch to oursql. It brings a lot of advantages over MySQLdb:
- oursql has real parameterization.
- oursql allows text or binary data to be streamed into the database and streamed out of the database, instead of requiring everything to be buffered in the client.
- oursql can both insert rows lazily and fetch rows lazily.
- oursql has unicode support on by default.
- oursql supports python 2.4 through 2.7 without any deprecation warnings on 2.6+ (see PEP 218) and without completely failing on 2.7 (see PEP 328).
- oursql is licensed under the BSD license.
来源：https://stackoverflow.com/questions/2424531/does-the-mysqldb-module-support-prepared-statements