在Python中进行SQL字符串拼接，包含`in`语句及变量（如`comic_name`）时，有多种方式可以实现。 #### 直接拼接 ```python comic_name = "特定漫画名称" video_types = ('废弃', '其他类型') # 假设还有其他类型 video_types_str = ", ".join([f"'{t}'" for t in video_types]) sql = "select * from video_info vi JOIN video_type_detail vtd ON vi.video_id = vtd.video_id where vi.comic_name like '%" + comic_name + "%' and vtd.video_type in (" + video_types_str + ")" print(sql) ``` #### 使用格式化字符串（Python 3.6及以上） ```python comic_name = "特定漫画名称" video_types = ('废弃', '其他类型') video_types_str = ", ".join([f"'{t}'" for t in video_types]) sql = f"select * from video_info vi JOIN video_type_detail vtd ON vi.video_id = vtd.video_id where vi.comic_name like '%{comic_name}%' and vtd.video_type in ({video_types_str})" print(sql) ``` #### 使用`str.format()`方法 ```python comic_name = "特定漫画名称" video_types = ('废弃', '其他类型') video_types_str = ", ".join([f"'{t}'" for t in video_types]) sql = "select * from video_info vi JOIN video_type_detail vtd ON vi.video_id = vtd.video_id where vi.comic_name like '%{}%' and vtd.video_type in ({})".format(comic_name, video_types_str) print(sql) ``` #### 参数化查询 为了防止SQL注入，建议使用参数化查询。以下是使用`sqlite3`库的示例： ```python import sqlite3 comic_name = "特定漫画名称" video_types = ('废弃', '其他类型') conn = sqlite3.connect('your_database.db') cursor = conn.cursor() placeholders = ', '.join(['?' for _ in video_types]) sql = f"select * from video_info vi JOIN video_type_detail vtd ON vi.video_id = vtd.video_id where vi.comic_name like? and vtd.video_type in ({placeholders})" params = ('%' + comic_name + '%',) + video_types cursor.execute(sql, params) results = cursor.fetchall() conn.close() ```