From 316a07a85fd0be31c18f05545700e74994e35421 Mon Sep 17 00:00:00 2001
From: Kakune55 <xiao_doubi9637@outlook.com>
Date: Wed, 13 Dec 2023 08:18:46 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A7=A3=E5=86=B3=E4=BA=86=E5=9B=A0=E4=B8=BA?=
 =?UTF-8?q?=E5=AD=97=E7=AC=A6=E4=B8=B2=E6=8B=BC=E6=8E=A5=E5=8F=AF=E8=83=BD?=
 =?UTF-8?q?=E5=AF=BC=E8=87=B4=E7=9A=84SQL=E6=B3=A8=E5=85=A5=E9=97=AE?=
 =?UTF-8?q?=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 db.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/db.py b/db.py
index 852baf0..f293752 100644
--- a/db.py
+++ b/db.py
@@ -12,7 +12,7 @@ def userSurplus(userkey):
     cursor = db.cursor()
  
     # 使用 execute()  方法执行 SQL 查询 
-    cursor.execute(f"SELECT surplus FROM usersurplus WHERE userkey = '{userkey}';")
+    cursor.execute(f"SELECT surplus FROM usersurplus WHERE userkey = %s;",[userkey])
     # 使用 fetchone() 方法获取单条数据.
     data = cursor.fetchone()
 
@@ -34,7 +34,7 @@ def reduce_value(userkey, value):  # 减去对应的值
     cursor = db.cursor()
 
     # 执行 SQL 查询以获取当前值
-    cursor.execute(f"SELECT surplus FROM usersurplus WHERE userkey = '{userkey}';")
+    cursor.execute(f"SELECT surplus FROM usersurplus WHERE userkey = %s;",[userkey])
     current_value = cursor.fetchone()[0]
 
     # 如果没有找到用户，则返回错误信息
@@ -46,7 +46,7 @@ def reduce_value(userkey, value):  # 减去对应的值
     new_value = current_value - value
 
     # 更新数据库中的值
-    cursor.execute(f"UPDATE usersurplus SET surplus={new_value} WHERE userkey='{userkey}'")
+    cursor.execute(f"UPDATE usersurplus SET surplus= %s WHERE userkey=%s",[new_value,userkey])
 
     # 提交事务
     db.commit()