SQL注入在%s占位符的字典傳參，示例代碼：
import pymysql
db = pymysql.connect(host="119.XX.XX.XX",
port=3306,
user="XXXXXXXX",
passwd="XXXXXXXXXXXXX",
db="XXXXXX",
charset='utf8')
# %s 占位符為需要傳遞的參數，切記不要加''雙引號，要不然會報錯
sql = "SELECT totalusercount * 1.4 FROM mm_project_uv_outdoor WHERE poiid = %s AND currenttime = %s"
cursor = db.cursor()
# 以下為傳遞多個參數的用法
cursor.execute(sql,['B00140N5CS','2019-04-23'])
# 傳遞單個參數時 cursor.execute(sql,'B00140N5CS')
print(cursor.fetchall())
db.close()
