pymysql prevent sql injection case

from pymysql import connect

main DEF ():
"" "SQL demo" ""
# 1. Enter a statement, the appropriate content based on the id display

id = input ( "Please enter a query id")

2. Execute the sql statement #
# create connection Connection
conn = Connect (Host = 'localhost', Port = 3306, Database = 'jing_dong', the User = 'root', password = 'MySQL', charset = 'utf8')
# get Cursor object
cs1 = conn.cursor ()

# Sql = "" "select * from goods where id =% s;" "" After% id sql statements do not directly use string concatenation
sql = "" "select * from goods where id =% s;" "" after # sql statements do not directly use string concatenation

Print # (SQL)
cs1.execute (SQL, (ID,)) where # parameters directly after passed

data = cs1.fetchall()

cs1.close()
conn.close()

# 3. Print the result of 2
for the TEMP in the Data:
Print (the TEMP)

if __name__ == '__main__':
main()