MYSQLDB模块的EXECUTE方法中表名不能使用占位符
大家好，请教一个问题，我在使用PYTHON操作MYSQL的时候，为了防止SQL注入，把SQL写成如下格式
cur.execute("select * from %s where name=%s",('t1','xx'))
但是执行的时候会报错，报错信息如下
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "build/bdist.linux-x86_64/egg/MySQLdb/cursors.py", line 174, in execute
File "build/bdist.linux-x86_64/egg/MySQLdb/connections.py", line 36, in defaulterrorhandler
_mysql_exceptions.ProgrammingError: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''t1' where name='xx'' at line 1")
看样子是execute方法在表名两边加上了两个单引号（select * from t1...变为select * from 't1'...）导致的，写成下面的格式就没问题
cur.execute("select * from t1 where name=%s",('xx',))
EXECUTE里表名不能被占位符替换？如何解决呢？
[解决办法]
哪个文档告诉你要这么写的？
