diff --git a/server/www/teleport/webroot/app/base/db.py b/server/www/teleport/webroot/app/base/db.py
index 789a125..c065312 100644
--- a/server/www/teleport/webroot/app/base/db.py
+++ b/server/www/teleport/webroot/app/base/db.py
@@ -19,6 +19,7 @@ __all__ = ['get_db', 'SQL']
 
 
 # TODO: use SQLAlchemy
+# https://www.jianshu.com/p/0d234e14b5d3
 
 
 class TPDatabase:
@@ -119,7 +120,7 @@ class TPDatabase:
         self.place_holder = '?'
         self.sqlite_file = db_file
 
-        self._table_prefix = 'tp_'
+        self._table_prefix = tp_cfg().database.db_prefix
         self._conn_pool = TPSqlitePool(db_file)
 
         if not os.path.exists(db_file):
@@ -455,13 +456,19 @@ class TPSqlitePool(TPDatabasePool):
             return False
 
     def _do_transaction(self, conn, sql_list):
+        # s = ''
+        # v = None
         try:
             # 使用context manager，发生异常时会自动rollback，正常执行完毕后会自动commit
             with conn:
-                for sql in sql_list:
-                    conn.execute(sql)
+                for item in sql_list:
+                    # s = item['s']
+                    # v = item['v']
+                    conn.execute(item['s'], item['v'])
             return True
         except Exception as e:
+            # log.d('|||', s, '|||', v, '|||', '\n')
+            # log.d('///', sql_list, '///', '\n')
             log.e('[sqlite] _do_transaction() failed: {}\n'.format(e.__str__()))
             return False
 
@@ -603,8 +610,8 @@ class TPMysqlPool(TPDatabasePool):
             cursor = conn.cursor()
             try:
                 conn.begin()
-                for sql in sql_list:
-                    cursor.execute(sql)
+                for item in sql_list:
+                    conn.execute(item['s'], item['v'])
                 conn.commit()
                 return True
             except pymysql.err.OperationalError as e:
@@ -858,7 +865,7 @@ class SQL:
         sql.append(';')
         return ' '.join(sql)
 
-    def query(self):
+    def query(self, vars=None):
         # 如果要分页，那么需要计算记录总数
         if self._limit is not None:
             sql = self._make_sql_counter_string()
@@ -874,14 +881,15 @@ class SQL:
 
         sql = self._make_sql_query_string()
         # log.d(sql, '\n')
-        db_ret = self._db.query(sql)
+        db_ret = self._db.query(sql, vars)
 
-        for db_item in db_ret:
-            item = AttrDict()
-            for i in range(len(self._output_fields)):
-                item[self._output_fields[i]] = db_item[i]
+        if db_ret is not None:
+            for db_item in db_ret:
+                item = AttrDict()
+                for i in range(len(self._output_fields)):
+                    item[self._output_fields[i]] = db_item[i]
 
-            self._ret_recorder.append(item)
+                self._ret_recorder.append(item)
 
         return TPE_OK
 
diff --git a/server/www/teleport/webroot/app/model/account.py b/server/www/teleport/webroot/app/model/account.py
index 0004953..cc5b6aa 100644
--- a/server/www/teleport/webroot/app/model/account.py
+++ b/server/www/teleport/webroot/app/model/account.py
@@ -310,7 +310,7 @@ def update_account(handler, host_id, acc_id, args):
     _router_ip = db_ret[0][2]
     _router_port = db_ret[0][3]
 
-    sql_list = []
+    sql_list = list()
 
     sql = list()
     sql.append('UPDATE `{}acc` SET'.format(db.table_prefix))
@@ -334,7 +334,7 @@ def update_account(handler, host_id, acc_id, args):
     # db_ret = db.exec(' '.join(sql))
     # if not db_ret:
     #     return TPE_DATABASE
-    sql_list.append(' '.join(sql))
+    sql_list.append({'s': ' '.join(sql), 'v': None})
 
     if len(_router_ip) == 0:
         _name = '{}@{}'.format(args['username'], _host_ip)
@@ -342,13 +342,13 @@ def update_account(handler, host_id, acc_id, args):
         _name = '{}@{} （由{}:{}路由）'.format(args['username'], _host_ip, _router_ip, _router_port)
 
     # 运维授权
-    sql = 'UPDATE `{}ops_auz` SET `name`="{name}" WHERE (`rtype`={rtype} AND `rid`={rid});'.format(db.table_prefix, name=_name, rtype=TP_ACCOUNT, rid=acc_id)
-    sql_list.append(sql)
-    sql = 'UPDATE `{}ops_map` SET `a_name`="{name}", `protocol_type`={protocol_type}, `protocol_port`={protocol_port} ' \
-          'WHERE (a_id={aid});'.format(db.table_prefix,
-                                       name=args['username'], protocol_type=args['protocol_type'], protocol_port=args['protocol_port'],
-                                       aid=acc_id)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}ops_auz` SET `name`={ph} WHERE (`rtype`={ph} AND `rid`={ph});'.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_list.append({'s': sql, 'v': (_name, TP_ACCOUNT, acc_id)})
+
+    sql_s = 'UPDATE `{tp}ops_map` SET `a_name`={ph},`protocol_type`={ph},`protocol_port`={ph} WHERE (`a_id`={ph});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (args['username'], args['protocol_type'], args['protocol_port'], acc_id)
+    sql_list.append({'s': sql_s, 'v': sql_v})
 
     if not db.transaction(sql_list):
         return TPE_DATABASE
@@ -366,20 +366,20 @@ def update_accounts_state(handler, host_id, acc_ids, state):
     if db_ret is None or len(db_ret) == 0:
         return TPE_NOT_EXISTS
 
-    sql_list = []
+    sql_list = list()
 
-    sql = 'UPDATE `{}acc` SET state={state} WHERE id IN ({ids});' \
-          ''.format(db.table_prefix, state=state, ids=acc_ids)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}acc` SET `state`={ph} WHERE `id` IN ({ids});' \
+          ''.format(tp=db.table_prefix, ph=db.place_holder, ids=acc_ids)
+    sql_list.append({'s': sql, 'v': (state, )})
 
     # sync to update the ops-audit table.
-    sql = 'UPDATE `{}ops_auz` SET state={state} WHERE rtype={rtype} AND rid IN ({rid});' \
-          ''.format(db.table_prefix, state=state, rtype=TP_ACCOUNT, rid=acc_ids)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}ops_auz` SET `state`={ph} WHERE `rtype`={ph} AND `rid` IN ({rid});' \
+          ''.format(tp=db.table_prefix, ph=db.place_holder, rid=acc_ids)
+    sql_list.append({'s': sql, 'v': (state, TP_ACCOUNT)})
 
-    sql = 'UPDATE `{}ops_map` SET a_state={state} WHERE a_id IN ({acc_id});' \
-          ''.format(db.table_prefix, state=state, acc_id=acc_ids)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}ops_map` SET `a_state`={ph} WHERE `a_id` IN ({acc_id});' \
+          ''.format(tp=db.table_prefix, ph=db.place_holder, acc_id=acc_ids)
+    sql_list.append({'s': sql, 'v': (state, )})
 
     if db.transaction(sql_list):
         return TPE_OK
@@ -424,23 +424,23 @@ def remove_accounts(handler, host_id, acc_ids):
             acc_name += '（由{}:{}路由）'.format(_h_router_ip, _h_router_port)
         acc_names.append(acc_name)
 
-    sql_list = []
+    sql_list = list()
 
-    sql = 'DELETE FROM `{}acc` WHERE host_id={} AND id IN ({});'.format(db.table_prefix, host_id, acc_ids)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}acc` WHERE `host_id`={ph} AND `id` IN ({ids});'.format(tp=db.table_prefix, ph=db.place_holder, ids=acc_ids)
+    sql_list.append({'s': sql, 'v': (host_id, )})
 
-    sql = 'DELETE FROM `{}group_map` WHERE type={} AND mid IN ({});'.format(db.table_prefix, TP_GROUP_ACCOUNT, acc_ids)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}group_map` WHERE `type`={ph} AND `mid` IN ({ids});'.format(tp=db.table_prefix, ph=db.place_holder, ids=acc_ids)
+    sql_list.append({'s': sql, 'v': (TP_GROUP_ACCOUNT, )})
 
     # 更新主机相关账号数量
-    sql = 'UPDATE `{}host` SET acc_count=acc_count-{acc_count} WHERE id={host_id};'.format(db.table_prefix, acc_count=acc_count, host_id=host_id)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}host` SET `acc_count`=`acc_count`-{ph} WHERE `id`={ph};'.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_list.append({'s': sql, 'v': (acc_count, host_id)})
 
-    sql = 'DELETE FROM `{}ops_auz` WHERE rtype={rtype} AND rid IN ({rid});'.format(db.table_prefix, rtype=TP_ACCOUNT, rid=acc_ids)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}ops_auz` WHERE `rtype`={ph} AND `rid` IN ({rid});'.format(tp=db.table_prefix, ph=db.place_holder, rid=acc_ids)
+    sql_list.append({'s': sql, 'v': (TP_ACCOUNT, )})
 
-    sql = 'DELETE FROM `{}ops_map` WHERE a_id IN ({acc_id});'.format(db.table_prefix, acc_id=acc_ids)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}ops_map` WHERE `a_id` IN ({acc_id});'.format(tp=db.table_prefix, acc_id=acc_ids)
+    sql_list.append({'s': sql, 'v': None})
 
     if not db.transaction(sql_list):
         return TPE_DATABASE
diff --git a/server/www/teleport/webroot/app/model/audit.py b/server/www/teleport/webroot/app/model/audit.py
index 0ce5aaa..bcd9940 100644
--- a/server/www/teleport/webroot/app/model/audit.py
+++ b/server/www/teleport/webroot/app/model/audit.py
@@ -122,14 +122,14 @@ def update_policies_state(handler, p_ids, state):
 
     sql_list = []
 
-    sql = 'UPDATE `{}audit_policy` SET `state`={state} WHERE `id` IN ({p_ids});'.format(db.table_prefix, state=state, p_ids=p_ids)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}audit_policy` SET `state`={ph} WHERE `id` IN ({p_ids});'.format(tp=db.table_prefix, ph=db.place_holder, p_ids=p_ids)
+    sql_list.append({'s': sql, 'v': (state, )})
 
-    sql = 'UPDATE `{}audit_auz` SET `state`={state} WHERE `policy_id` IN ({p_ids});'.format(db.table_prefix, state=state, p_ids=p_ids)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}audit_auz` SET `state`={ph} WHERE `policy_id` IN ({p_ids});'.format(tp=db.table_prefix, ph=db.place_holder, p_ids=p_ids)
+    sql_list.append({'s': sql, 'v': (state, )})
 
-    sql = 'UPDATE `{}audit_map` SET `p_state`={state} WHERE `p_id` IN ({p_ids});'.format(db.table_prefix, state=state, p_ids=p_ids)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}audit_map` SET `p_state`={ph} WHERE `p_id` IN ({p_ids});'.format(tp=db.table_prefix, ph=db.place_holder, p_ids=p_ids)
+    sql_list.append({'s': sql, 'v': (state, )})
 
     if db.transaction(sql_list):
         return TPE_OK
@@ -144,14 +144,14 @@ def remove_policies(handler, p_ids):
 
     sql_list = []
 
-    sql = 'DELETE FROM `{}audit_policy` WHERE `id` IN ({p_ids});'.format(db.table_prefix, p_ids=p_ids)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}audit_policy` WHERE `id` IN ({p_ids});'.format(tp=db.table_prefix, p_ids=p_ids)
+    sql_list.append({'s': sql, 'v': None})
 
-    sql = 'DELETE FROM `{}audit_auz` WHERE `policy_id` IN ({p_ids});'.format(db.table_prefix, p_ids=p_ids)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}audit_auz` WHERE `policy_id` IN ({p_ids});'.format(tp=db.table_prefix, p_ids=p_ids)
+    sql_list.append({'s': sql, 'v': None})
 
-    sql = 'DELETE FROM `{}audit_map` WHERE `p_id` IN ({p_ids});'.format(db.table_prefix, p_ids=p_ids)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}audit_map` WHERE `p_id` IN ({p_ids});'.format(tp=db.table_prefix, p_ids=p_ids)
+    sql_list.append({'s': sql, 'v': None})
 
     if db.transaction(sql_list):
         return TPE_OK
@@ -185,13 +185,11 @@ def add_members(handler, policy_id, policy_type, ref_type, members):
     for m in members:
         if m['id'] in exists_ids:
             continue
-        str_sql = 'INSERT INTO `{}audit_auz` (policy_id, type, rtype, rid, `name`, creator_id, create_time) VALUES ' \
-                  '({pid}, {t}, {rtype}, {rid}, "{name}", {creator_id}, {create_time});' \
-                  ''.format(db.table_prefix,
-                            pid=policy_id, t=policy_type, rtype=ref_type,
-                            rid=m['id'], name=m['name'],
-                            creator_id=operator['id'], create_time=_time_now)
-        sql.append(str_sql)
+        sql_s = 'INSERT INTO `{tp}audit_auz` (`policy_id`,`type`,`rtype`,`rid`,`name`,`creator_id`,`create_time`) VALUES ' \
+                '({ph},{ph},{ph},{ph},{ph},{ph},{ph});' \
+                ''.format(tp=db.table_prefix, ph=db.place_holder)
+        sql_v = (policy_id, policy_type, ref_type, m['id'], m['name'], operator['id'], _time_now)
+        sql.append({'s': sql_s, 'v': sql_v})
 
     if db.transaction(sql):
         # return TPE_OK
diff --git a/server/www/teleport/webroot/app/model/group.py b/server/www/teleport/webroot/app/model/group.py
index 59c13db..f0656d3 100644
--- a/server/www/teleport/webroot/app/model/group.py
+++ b/server/www/teleport/webroot/app/model/group.py
@@ -56,20 +56,20 @@ def update_groups_state(handler, gtype, glist, state):
     group_list = ','.join([str(i) for i in glist])
 
     db = get_db()
-    sql_list = []
+    sql_list = list()
 
     # 2. 更新记录
-    sql = 'UPDATE `{}ops_auz` SET state={state} WHERE rtype={rtype} AND rid={rid};' \
-          ''.format(db.table_prefix, state=state, rtype=gtype, rid=group_list)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}ops_auz` SET `state`={ph} WHERE `rtype`={ph} AND `rid` IN ({rid});' \
+          ''.format(tp=db.table_prefix, ph=db.place_holder, rid=group_list)
+    sql_list.append({'s': sql, 'v': (state, gtype)})
 
-    sql = 'UPDATE `{}ops_map` SET {gname}_state={state} WHERE {gname}_id IN ({gids});' \
-          ''.format(db.table_prefix, state=state, gname=gname, gids=group_list)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}ops_map` SET `{gname}_state`={ph} WHERE `{gname}_id` IN ({gids});' \
+          ''.format(tp=db.table_prefix, ph=db.place_holder, gname=gname, gids=group_list)
+    sql_list.append({'s': sql, 'v': (state,)})
 
-    sql = 'UPDATE `{dbtp}group` SET state={state} WHERE id IN ({gids});' \
-          ''.format(dbtp=db.table_prefix, state=state, gids=group_list)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}group` SET `state`={ph} WHERE `id` IN ({gids});' \
+          ''.format(tp=db.table_prefix, ph=db.place_holder, gids=group_list)
+    sql_list.append({'s': sql, 'v': (state,)})
 
     if db.transaction(sql_list):
         return TPE_OK
@@ -96,11 +96,11 @@ def remove(handler, gtype, glist):
 
     name_list = [n['name'] for n in s.recorder]
 
-    sql_list = []
+    sql_list = list()
 
     # 删除组与成员的映射关系
-    sql = 'DELETE FROM `{tpdp}group_map` WHERE `type`={t} AND `gid` IN ({ids});'.format(tpdp=db.table_prefix, t=gtype, ids=group_ids)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}group_map` WHERE `type`={ph} AND `gid` IN ({ids});'.format(tp=db.table_prefix, ph=db.place_holder, ids=group_ids)
+    sql_list.append({'s': sql, 'v': (gtype,)})
 
     # where = 'type={} AND gid IN ({})'.format(gtype, ','.join(group_list))
     # err = s.reset().delete_from('group_map').where(where).exec()
@@ -108,8 +108,8 @@ def remove(handler, gtype, glist):
     #     return err
 
     # 删除组
-    sql = 'DELETE FROM `{tpdp}group` WHERE `type`={t} AND `id` IN ({ids});'.format(tpdp=db.table_prefix, t=gtype, ids=group_ids)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}group` WHERE `type`={ph} AND `id` IN ({ids});'.format(tp=db.table_prefix, ph=db.place_holder, ids=group_ids)
+    sql_list.append({'s': sql, 'v': (gtype,)})
     # where = 'type={gtype} AND id IN ({gids})'.format(gtype=gtype, gids=','.join(group_list))
     # err = s.reset().delete_from('group').where(where).exec()
     # if err != TPE_OK:
@@ -125,17 +125,17 @@ def remove(handler, gtype, glist):
         return TPE_PARAM
 
     # 将组从运维授权中移除
-    sql = 'DELETE FROM `{}ops_auz` WHERE `rtype`={rtype} AND `rid` IN ({ids});'.format(db.table_prefix, rtype=gtype, ids=group_ids)
-    sql_list.append(sql)
-    sql = 'DELETE FROM `{}ops_map` WHERE `{gname}_id` IN ({ids});'.format(db.table_prefix, gname=gname, ids=group_ids)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}ops_auz` WHERE `rtype`={ph} AND `rid` IN ({ids});'.format(tp=db.table_prefix, ph=db.place_holder, ids=group_ids)
+    sql_list.append({'s': sql, 'v': (gtype,)})
+    sql = 'DELETE FROM `{tp}ops_map` WHERE `{gname}_id` IN ({ids});'.format(tp=db.table_prefix, gname=gname, ids=group_ids)
+    sql_list.append({'s': sql, 'v': None})
     # 将组从审计授权中移除
-    sql = 'DELETE FROM `{}audit_auz` WHERE `rtype`={rtype} AND `rid` IN ({ids});'.format(db.table_prefix, rtype=gtype, ids=group_ids)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}audit_auz` WHERE `rtype`={ph} AND `rid` IN ({ids});'.format(tp=db.table_prefix, ph=db.place_holder, ids=group_ids)
+    sql_list.append({'s': sql, 'v': (gtype,)})
     # 注意，审计授权映射表中，没有远程账号相关信息，所以如果是远程账号组，则忽略
     if gtype != TP_GROUP_ACCOUNT:
-        sql = 'DELETE FROM `{}audit_map` WHERE `{gname}_id` IN ({ids});'.format(db.table_prefix, gname=gname, ids=group_ids)
-        sql_list.append(sql)
+        sql = 'DELETE FROM `{tp}audit_map` WHERE `{gname}_id` IN ({ids});'.format(tp=db.table_prefix, gname=gname, ids=group_ids)
+        sql_list.append({'s': sql, 'v': None})
 
     if not db.transaction(sql_list):
         return TPE_DATABASE
@@ -178,20 +178,19 @@ def update(handler, gid, name, desc):
         return TPE_NOT_EXISTS
 
     gtype = db_ret[0][1]
-    sql_list = []
+    sql_list = list()
 
     # 2. 更新记录
-    sql = 'UPDATE `{}group` SET `name`="{name}", `desc`="{desc}" WHERE id={gid};' \
-          ''.format(db.table_prefix, name=name, desc=desc, gid=gid)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}group` SET `name`={ph}, `desc`={ph} WHERE `id`={ph};'.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_list.append({'s': sql, 'v': (name, desc, gid)})
 
     # 3. 同步更新授权表和权限映射表
     # 运维授权
-    sql = 'UPDATE `{}ops_auz` SET `name`="{name}" WHERE (`rtype`={rtype} AND `rid`={rid});'.format(db.table_prefix, name=name, rtype=gtype, rid=gid)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}ops_auz` SET `name`={ph} WHERE (`rtype`={ph} AND `rid`={ph});'.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_list.append({'s': sql, 'v': (name, gtype, gid)})
     # 审计授权
-    sql = 'UPDATE `{}audit_auz` SET `name`="{name}" WHERE (`rtype`={rtype} AND `rid`={rid});'.format(db.table_prefix, name=name, rtype=gtype, rid=gid)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}audit_auz` SET `name`={ph} WHERE (`rtype`={ph} AND `rid`={ph});'.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_list.append({'s': sql, 'v': (name, gtype, gid)})
 
     if not db.transaction(sql_list):
         return TPE_DATABASE
@@ -203,10 +202,12 @@ def add_members(gtype, gid, members):
     # 向指定组中增加成员，同时根据授权策略，更新授权映射表
     db = get_db()
 
-    sql = []
+    sql_list = list()
     for uid in members:
-        sql.append('INSERT INTO `{}group_map` (`type`, `gid`, `mid`) VALUES ({}, {}, {});'.format(db.table_prefix, gtype, gid, uid))
-    if db.transaction(sql):
+        sql = 'INSERT INTO `{tp}group_map` (`type`,`gid`,`mid`) VALUES ({ph},{ph},{ph});'.format(tp=db.table_prefix, ph=db.place_holder)
+        sql_list.append({'s': sql, 'v': (gtype, gid, uid)})
+
+    if db.transaction(sql_list):
         return policy.rebuild_auz_map()
     else:
         return TPE_DATABASE
@@ -229,16 +230,20 @@ def remove_members(gtype, gid, members):
 
     mids = ','.join([str(uid) for uid in members])
 
-    sql_list = []
+    sql_list = list()
+
+    sql = 'DELETE FROM `{tp}group_map` WHERE (`type`={ph} AND `gid`={ph} AND `mid` IN ({mids}));' \
+          ''.format(tp=db.table_prefix, ph=db.place_holder, mids=mids)
+    sql_list.append({'s': sql, 'v': (gtype, gid)})
+
+    sql = 'DELETE FROM `{tp}ops_map` WHERE `{gname}_id`={ph} AND `{name}_id` IN ({ids});' \
+          ''.format(tp=db.table_prefix, ph=db.place_holder, gname=gname, name=name, ids=mids)
+    sql_list.append({'s': sql, 'v': (gid,)})
 
-    _where = 'WHERE (type={gtype} AND gid={gid} AND mid IN ({mid}))'.format(gtype=gtype, gid=gid, mid=mids)
-    sql = 'DELETE FROM `{dbtp}group_map` {where};'.format(dbtp=db.table_prefix, where=_where)
-    sql_list.append(sql)
-    sql = 'DELETE FROM `{}ops_map` WHERE {gname}_id={gid} AND {name}_id IN ({ids});'.format(db.table_prefix, gname=gname, name=name, gid=gid, ids=mids)
-    sql_list.append(sql)
     if gtype != TP_GROUP_ACCOUNT:
-        sql = 'DELETE FROM `{}audit_map` WHERE {gname}_id={gid} AND {name}_id IN ({ids});'.format(db.table_prefix, gname=gname, name=name, gid=gid, ids=mids)
-        sql_list.append(sql)
+        sql = 'DELETE FROM `{tp}audit_map` WHERE `{gname}_id`={ph} AND `{name}_id` IN ({ids});' \
+              ''.format(tp=db.table_prefix, ph=db.place_holder, gname=gname, name=name, ids=mids)
+        sql_list.append({'s': sql, 'v': (gid,)})
 
     if db.transaction(sql_list):
         return TPE_OK
diff --git a/server/www/teleport/webroot/app/model/host.py b/server/www/teleport/webroot/app/model/host.py
index 84ec4fe..bb6fc2d 100644
--- a/server/www/teleport/webroot/app/model/host.py
+++ b/server/www/teleport/webroot/app/model/host.py
@@ -137,7 +137,7 @@ def remove_hosts(handler, hosts):
 
     host_ids = ','.join([str(i) for i in hosts])
 
-    sql_list = []
+    sql_list = list()
 
     # step 1. 处理主机对应的账号
 
@@ -164,23 +164,23 @@ def remove_hosts(handler, hosts):
     if len(accs) > 0:
         # 1.2 将账号从所在组中移除
         where = 'mid IN ({})'.format(acc_ids)
-        sql = 'DELETE FROM `{}group_map` WHERE (type={} AND {});'.format(db.table_prefix, TP_GROUP_ACCOUNT, where)
-        sql_list.append(sql)
+        sql = 'DELETE FROM `{tp}group_map` WHERE (`type`={ph} AND {w});'.format(tp=db.table_prefix, ph=db.place_holder, w=where)
+        sql_list.append({'s': sql, 'v': (TP_GROUP_ACCOUNT, )})
         # if not db.exec(sql):
         #     return TPE_DATABASE
 
         # 1.3 将账号删除
         where = 'id IN ({})'.format(acc_ids)
-        sql = 'DELETE FROM `{}acc` WHERE {};'.format(db.table_prefix, where)
-        sql_list.append(sql)
+        sql = 'DELETE FROM `{tp}acc` WHERE {w};'.format(tp=db.table_prefix, w=where)
+        sql_list.append({'s': sql, 'v': None})
         # if not db.exec(sql):
         #     return TPE_DATABASE
 
-        sql = 'DELETE FROM `{}ops_auz` WHERE rtype={rtype} AND rid IN ({rid});'.format(db.table_prefix, rtype=TP_ACCOUNT, rid=acc_ids)
-        sql_list.append(sql)
+        sql = 'DELETE FROM `{tp}ops_auz` WHERE `rtype`={ph} AND `rid` IN ({rid});'.format(tp=db.table_prefix, ph=db.place_holder, rid=acc_ids)
+        sql_list.append({'s': sql, 'v': (TP_ACCOUNT, )})
 
-        sql = 'DELETE FROM `{}ops_map` WHERE a_id IN ({acc_ids});'.format(db.table_prefix, acc_ids=acc_ids)
-        sql_list.append(sql)
+        sql = 'DELETE FROM `{tp}ops_map` WHERE `a_id` IN ({acc_ids});'.format(tp=db.table_prefix, acc_ids=acc_ids)
+        sql_list.append({'s': sql, 'v': None})
 
     # step 2. 处理主机
     s = SQL(db)
@@ -200,18 +200,18 @@ def remove_hosts(handler, hosts):
 
     # 2.1 将主机从所在组中移除
     where = 'mid IN ({})'.format(host_ids)
-    sql = 'DELETE FROM `{}group_map` WHERE (type={} AND {});'.format(db.table_prefix, TP_GROUP_HOST, where)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}group_map` WHERE (`type`={ph} AND {w});'.format(tp=db.table_prefix, ph=db.place_holder, w=where)
+    sql_list.append({'s': sql, 'v': (TP_GROUP_HOST, )})
 
     # 2.2 将主机删除
     where = 'id IN ({})'.format(host_ids)
-    sql = 'DELETE FROM `{}host` WHERE {};'.format(db.table_prefix, where)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}host` WHERE {w};'.format(tp=db.table_prefix, w=where)
+    sql_list.append({'s': sql, 'v': None})
 
-    sql = 'DELETE FROM `{}ops_auz` WHERE rtype={rtype} AND rid IN ({rid});'.format(db.table_prefix, rtype=TP_HOST, rid=host_ids)
-    sql_list.append(sql)
-    sql = 'DELETE FROM `{}ops_map` WHERE h_id IN ({host_ids});'.format(db.table_prefix, host_ids=host_ids)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}ops_auz` WHERE `rtype`={ph} AND rid IN ({rid});'.format(tp=db.table_prefix, ph=db.place_holder, rid=host_ids)
+    sql_list.append({'s': sql, 'v': (TP_HOST, )})
+    sql = 'DELETE FROM `{tp}ops_map` WHERE h_id IN ({host_ids});'.format(tp=db.table_prefix, host_ids=host_ids)
+    sql_list.append({'s': sql, 'v': None})
 
     if not db.transaction(sql_list):
         return TPE_DATABASE
@@ -238,19 +238,18 @@ def update_host(handler, args):
     if db_ret is None or len(db_ret) == 0:
         return TPE_NOT_EXISTS
 
-    sql_list = []
-    sql = 'UPDATE `{}host` SET `os_type`={os_type}, `name`="{name}", `ip`="{ip}", `router_ip`="{router_ip}", ' \
-          '`router_port`={router_port}, `cid`="{cid}", `desc`="{desc}" WHERE `id`={host_id};' \
-          ''.format(db.table_prefix,
-                    os_type=args['os_type'], name=args['name'], ip=args['ip'], router_ip=args['router_ip'], router_port=args['router_port'],
-                    cid=args['cid'], desc=args['desc'], host_id=args['id'])
-    sql_list.append(sql)
+    sql_list = list()
+    sql_s = 'UPDATE `{tp}host` SET `os_type`={ph},`name`={ph},`ip`={ph},`router_ip`={ph}, ' \
+            '`router_port`={ph},`cid`={ph},`desc`={ph} WHERE `id`={ph};' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (args['os_type'], args['name'], args['ip'], args['router_ip'], args['router_port'], args['cid'], args['desc'], args['id'])
+    sql_list.append({'s': sql_s, 'v': sql_v})
 
     # 更新所有此主机相关的账号
-    sql = 'UPDATE `{}acc` SET `host_ip`="{ip}", `router_ip`="{router_ip}", `router_port`={router_port} WHERE `host_id`={id};' \
-          ''.format(db.table_prefix,
-                    ip=args['ip'], router_ip=args['router_ip'], router_port=args['router_port'], id=args['id'])
-    sql_list.append(sql)
+    sql_s = 'UPDATE `{tp}acc` SET `host_ip`={ph},`router_ip`={ph},`router_port`={ph} WHERE `host_id`={ph};' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (args['ip'], args['router_ip'], args['router_port'], args['id'])
+    sql_list.append({'s': sql_s, 'v': sql_v})
 
     # 同步更新授权表和权限映射表
     _name = args['ip']
@@ -258,22 +257,26 @@ def update_host(handler, args):
         _name = '{} [{}]'.format(args['name'], args['ip'])
 
     # 运维授权
-    sql = 'UPDATE `{}ops_auz` SET `name`="{name}" WHERE (`rtype`={rtype} AND `rid`={rid});' \
-          ''.format(db.table_prefix, name=_name, rtype=TP_HOST, rid=args['id'])
-    sql_list.append(sql)
-    sql = 'UPDATE `{}ops_map` SET `h_name`="{hname}", `ip`="{ip}", `router_ip`="{router_ip}", `router_port`={router_port} ' \
-          'WHERE (h_id={hid});'.format(db.table_prefix,
-                                       hname=args['name'], ip=args['ip'], hid=args['id'],
-                                       router_ip=args['router_ip'], router_port=args['router_port'])
-    sql_list.append(sql)
+    sql_s = 'UPDATE `{tp}ops_auz` SET `name`={ph} WHERE (`rtype`={ph} AND `rid`={ph});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (_name, TP_HOST, args['id'])
+    sql_list.append({'s': sql_s, 'v': sql_v})
+
+    sql_s = 'UPDATE `{tp}ops_map` SET `h_name`={ph},`ip`={ph},`router_ip`={ph},`router_port`={ph} WHERE (`h_id`={ph});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (args['name'], args['ip'], args['router_ip'], args['router_port'], args['id'])
+    sql_list.append({'s': sql_s, 'v': sql_v})
+
     # 审计授权
-    sql = 'UPDATE `{}audit_auz` SET `name`="{name}" WHERE (`rtype`={rtype} AND `rid`={rid});'.format(db.table_prefix, name=_name, rtype=TP_HOST, rid=args['id'])
-    sql_list.append(sql)
-    sql = 'UPDATE `{}audit_map` SET `h_name`="{hname}", `ip`="{ip}", `router_ip`="{router_ip}", `router_port`={router_port} ' \
-          'WHERE (h_id={hid});'.format(db.table_prefix,
-                                       hname=args['name'], ip=args['ip'], hid=args['id'],
-                                       router_ip=args['router_ip'], router_port=args['router_port'])
-    sql_list.append(sql)
+    sql_s = 'UPDATE `{tp}audit_auz` SET `name`={ph} WHERE (`rtype`={ph} AND `rid`={ph});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (_name, TP_HOST, args['id'])
+    sql_list.append({'s': sql_s, 'v': sql_v})
+
+    sql_s = 'UPDATE `{tp}audit_map` SET `h_name`={ph}, `ip`={ph}, `router_ip`={ph}, `router_port`={ph} WHERE (`h_id`={ph});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (args['name'], args['ip'], args['router_ip'], args['router_port'], args['id'])
+    sql_list.append({'s': sql_s, 'v': sql_v})
 
     if not db.transaction(sql_list):
         return TPE_DATABASE
@@ -289,20 +292,20 @@ def update_hosts_state(handler, host_ids, state):
 
     host_ids = ','.join([str(i) for i in host_ids])
 
-    sql_list = []
+    sql_list = list()
 
-    sql = 'UPDATE `{}host` SET `state`={state} WHERE `id` IN ({host_ids});' \
-          ''.format(db.table_prefix, state=state, host_ids=host_ids)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}host` SET `state`={ph} WHERE `id` IN ({host_ids});' \
+          ''.format(tp=db.table_prefix, ph=db.place_holder, host_ids=host_ids)
+    sql_list.append({'s': sql, 'v': (state, )})
 
     # sync to update the ops-audit table.
-    sql = 'UPDATE `{}ops_auz` SET `state`={state} WHERE `rtype`={rtype} AND `rid` IN ({rid});' \
-          ''.format(db.table_prefix, state=state, rtype=TP_ACCOUNT, rid=host_ids)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}ops_auz` SET `state`={ph} WHERE `rtype`={ph} AND `rid` IN ({rid});' \
+          ''.format(tp=db.table_prefix, ph=db.place_holder, rid=host_ids)
+    sql_list.append({'s': sql, 'v': (state, TP_ACCOUNT)})
 
-    sql = 'UPDATE `{}ops_map` SET `h_state`={state} WHERE `h_id` IN ({host_ids});' \
-          ''.format(db.table_prefix, state=state, host_ids=host_ids)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}ops_map` SET `h_state`={ph} WHERE `h_id` IN ({host_ids});' \
+          ''.format(tp=db.table_prefix, ph=db.place_holder, host_ids=host_ids)
+    sql_list.append({'s': sql, 'v': (state, )})
 
     if db.transaction(sql_list):
         return TPE_OK
diff --git a/server/www/teleport/webroot/app/model/ops.py b/server/www/teleport/webroot/app/model/ops.py
index 8904b97..a996f20 100644
--- a/server/www/teleport/webroot/app/model/ops.py
+++ b/server/www/teleport/webroot/app/model/ops.py
@@ -135,14 +135,14 @@ def update_policies_state(handler, p_ids, state):
 
     sql_list = []
 
-    sql = 'UPDATE `{}ops_policy` SET `state`={state} WHERE `id` IN ({p_ids});'.format(db.table_prefix, state=state, p_ids=p_ids)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}ops_policy` SET `state`={ph} WHERE `id` IN ({p_ids});'.format(tp=db.table_prefix, ph=db.place_holder, p_ids=p_ids)
+    sql_list.append({'s': sql, 'v': (state, )})
 
-    sql = 'UPDATE `{}ops_auz` SET `state`={state} WHERE `policy_id` IN ({p_ids});'.format(db.table_prefix, state=state, p_ids=p_ids)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}ops_auz` SET `state`={ph} WHERE `policy_id` IN ({p_ids});'.format(tp=db.table_prefix, ph=db.place_holder, p_ids=p_ids)
+    sql_list.append({'s': sql, 'v': (state, )})
 
-    sql = 'UPDATE `{}ops_map` SET `p_state`={state} WHERE `p_id` IN ({p_ids});'.format(db.table_prefix, state=state, p_ids=p_ids)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}ops_map` SET `p_state`={ph} WHERE `p_id` IN ({p_ids});'.format(tp=db.table_prefix, ph=db.place_holder, p_ids=p_ids)
+    sql_list.append({'s': sql, 'v': (state, )})
 
     if db.transaction(sql_list):
         return TPE_OK
@@ -158,13 +158,13 @@ def remove_policies(handler, p_ids):
     sql_list = []
 
     sql = 'DELETE FROM `{}ops_policy` WHERE `id` IN ({p_ids});'.format(db.table_prefix, p_ids=p_ids)
-    sql_list.append(sql)
+    sql_list.append({'s': sql, 'v': None})
 
     sql = 'DELETE FROM `{}ops_auz` WHERE `policy_id` IN ({p_ids});'.format(db.table_prefix, p_ids=p_ids)
-    sql_list.append(sql)
+    sql_list.append({'s': sql, 'v': None})
 
     sql = 'DELETE FROM `{}ops_map` WHERE `p_id` IN ({p_ids});'.format(db.table_prefix, p_ids=p_ids)
-    sql_list.append(sql)
+    sql_list.append({'s': sql, 'v': None})
 
     if db.transaction(sql_list):
         return TPE_OK
@@ -195,13 +195,11 @@ def add_members(handler, policy_id, policy_type, ref_type, members):
     for m in members:
         if m['id'] in exists_ids:
             continue
-        str_sql = 'INSERT INTO `{}ops_auz` (policy_id, type, rtype, rid, `name`, creator_id, create_time) VALUES ' \
-                  '({pid}, {t}, {rtype}, {rid}, "{name}", {creator_id}, {create_time});' \
-                  ''.format(db.table_prefix,
-                            pid=policy_id, t=policy_type, rtype=ref_type,
-                            rid=m['id'], name=m['name'],
-                            creator_id=operator['id'], create_time=_time_now)
-        sql.append(str_sql)
+        sql_s = 'INSERT INTO `{tp}ops_auz` (`policy_id`,`type`,`rtype`,`rid`,`name`,`creator_id`,`create_time`) VALUES ' \
+                '({ph}, {ph}, {ph}, {ph}, {ph}, {ph}, {ph});' \
+                ''.format(tp=db.table_prefix, ph=db.place_holder)
+        sql_v = (policy_id, policy_type, ref_type, m['id'], m['name'], operator['id'], _time_now)
+        sql.append({'s': sql_s, 'v': sql_v})
 
     if db.transaction(sql):
         # return TPE_OK
@@ -221,7 +219,7 @@ def remove_members(handler, policy_id, policy_type, ids):
     if err != TPE_OK:
         return err
 
-    #return TPE_OK
+    # return TPE_OK
     return policy.rebuild_ops_auz_map()
 
 
diff --git a/server/www/teleport/webroot/app/model/record.py b/server/www/teleport/webroot/app/model/record.py
index 29d4b07..a3b797d 100644
--- a/server/www/teleport/webroot/app/model/record.py
+++ b/server/www/teleport/webroot/app/model/record.py
@@ -476,15 +476,18 @@ def session_fix():
     if db.need_create or db.need_upgrade:
         return TPE_OK
 
-    sql_list = []
+    sql_list = list()
 
-    sql = 'UPDATE `{dbtp}record` SET state={new_state}, time_end={time_end} WHERE state={old_state};' \
-          ''.format(dbtp=db.table_prefix, new_state=TP_SESS_STAT_ERR_RESET, old_state=TP_SESS_STAT_RUNNING, time_end=tp_timestamp_sec())
-    sql_list.append(sql)
+    sql_s = 'UPDATE `{tp}record` SET state={ph}, time_end={ph} WHERE state={ph};' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (TP_SESS_STAT_ERR_RESET, tp_timestamp_sec(), TP_SESS_STAT_RUNNING)
+    sql_list.append({'s': sql_s, 'v': sql_v})
+
+    sql_s = 'UPDATE `{tp}record` SET state={ph},time_end={ph} WHERE state={ph};' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (TP_SESS_STAT_ERR_RESET, tp_timestamp_sec(), TP_SESS_STAT_STARTED)
+    sql_list.append({'s': sql_s, 'v': sql_v})
 
-    sql = 'UPDATE `{dbtp}record` SET state={new_state},time_end={time_end} WHERE state={old_state};' \
-          ''.format(dbtp=db.table_prefix, new_state=TP_SESS_STAT_ERR_START_RESET, old_state=TP_SESS_STAT_STARTED, time_end=tp_timestamp_sec())
-    sql_list.append(sql)
     return db.transaction(sql_list)
 
 
diff --git a/server/www/teleport/webroot/app/model/system.py b/server/www/teleport/webroot/app/model/system.py
index b96a27a..8d0d3e2 100644
--- a/server/www/teleport/webroot/app/model/system.py
+++ b/server/www/teleport/webroot/app/model/system.py
@@ -93,14 +93,14 @@ def remove_role(handler, role_id):
 
     role_name = s.recorder[0].name
 
-    sql_list = []
+    sql_list = list()
 
-    sql = 'DELETE FROM `{}role` WHERE id={};'.format(db.table_prefix, role_id)
-    sql_list.append(sql)
+    sql = 'DELETE FROM `{tp}role` WHERE `id`={ph};'.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_list.append({'s': sql, 'v': (role_id, )})
 
     # 更新此角色相关的用户信息
-    sql = 'UPDATE `{}user` SET role_id=0 WHERE role_id={rid};'.format(db.table_prefix, rid=role_id)
-    sql_list.append(sql)
+    sql = 'UPDATE `{tp}user` SET `role_id`=0 WHERE `role_id`={ph};'.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_list.append({'s': sql, 'v': (role_id, )})
 
     if not db.transaction(sql_list):
         return TPE_DATABASE
diff --git a/server/www/teleport/webroot/app/model/user.py b/server/www/teleport/webroot/app/model/user.py
index 726d366..4828c3b 100755
--- a/server/www/teleport/webroot/app/model/user.py
+++ b/server/www/teleport/webroot/app/model/user.py
@@ -424,19 +424,26 @@ def update_user(handler, args):
         _uname += '（' + args['surname'] + '）'
     sql_list = []
     # 运维授权
-    sql = 'UPDATE `{}ops_auz` SET `name`="{uname}" WHERE (`rtype`={rtype} AND `rid`={rid});' \
-          ''.format(db.table_prefix, uname=_uname, rtype=TP_USER, rid=args['id'])
-    sql_list.append(sql)
-    sql = 'UPDATE `{}ops_map` SET `u_name`="{uname}", `u_surname`="{surname}" WHERE (u_id={uid});'.format(
-        db.table_prefix, uname=args['username'], surname=args['surname'], uid=args['id'])
-    sql_list.append(sql)
+    sql_s = 'UPDATE `{tp}ops_auz` SET `name`={ph} WHERE (`rtype`={ph} AND `rid`={ph});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (_uname, TP_USER, args['id'])
+    sql_list.append({'s': sql_s, 'v': sql_v})
+
+    sql_s = 'UPDATE `{tp}ops_map` SET `u_name`={ph}, `u_surname`={ph} WHERE (u_id={ph});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (args['username'], args['surname'], args['id'])
+    sql_list.append({'s': sql_s, 'v': sql_v})
+
     # 审计授权
-    sql = 'UPDATE `{}audit_auz` SET `name`="{uname}" WHERE (`rtype`={rtype} AND `rid`={rid});' \
-          ''.format(db.table_prefix, uname=_uname, rtype=TP_USER, rid=args['id'])
-    sql_list.append(sql)
-    sql = 'UPDATE `{}audit_map` SET `u_name`="{uname}", `u_surname`="{surname}" WHERE (u_id={uid});'.format(
-        db.table_prefix, uname=args['username'], surname=args['surname'], uid=args['id'])
-    sql_list.append(sql)
+    sql_s = 'UPDATE `{tp}audit_auz` SET `name`={ph} WHERE (`rtype`={ph} AND `rid`={ph});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (_uname, TP_USER, args['id'])
+    sql_list.append({'s': sql_s, 'v': sql_v})
+
+    sql_s = 'UPDATE `{tp}audit_map` SET `u_name`={ph}, `u_surname`={ph} WHERE (u_id={ph});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (args['username'], args['surname'], args['id'])
+    sql_list.append({'s': sql_s, 'v': sql_v})
 
     if not db.transaction(sql_list):
         return TPE_DATABASE
@@ -630,25 +637,30 @@ def update_users_state(handler, user_ids, state):
 
     sql_list = []
 
-    sql = 'UPDATE `{}user` SET state={state} WHERE id IN ({ids});' \
-          ''.format(db.table_prefix, state=state, ids=user_ids)
-    sql_list.append(sql)
+    sql_s = 'UPDATE `{tp}user` SET `state`={ph} WHERE `id` IN ({ids});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder, ids=user_ids)
+    sql_v = (state, )
+    sql_list.append({'s': sql_s, 'v': sql_v})
 
-    sql = 'UPDATE `{}ops_auz` SET state={state} WHERE rtype={rtype} AND rid IN ({rid});' \
-          ''.format(db.table_prefix, state=state, rtype=TP_USER, rid=user_ids)
-    sql_list.append(sql)
+    sql_s = 'UPDATE `{tp}ops_auz` SET `state`={ph} WHERE `rtype`={ph} AND `rid` IN ({ids});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder, ids=user_ids)
+    sql_v = (state, TP_USER)
+    sql_list.append({'s': sql_s, 'v': sql_v})
 
-    sql = 'UPDATE `{}ops_map` SET u_state={state} WHERE u_id IN ({ids});' \
-          ''.format(db.table_prefix, state=state, ids=user_ids)
-    sql_list.append(sql)
+    sql_s = 'UPDATE `{tp}ops_map` SET `u_state`={ph} WHERE `u_id` IN ({ids});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder, ids=user_ids)
+    sql_v = (state, )
+    sql_list.append({'s': sql_s, 'v': sql_v})
 
-    sql = 'UPDATE `{}audit_auz` SET state={state} WHERE rtype={rtype} AND rid IN ({rid});' \
-          ''.format(db.table_prefix, state=state, rtype=TP_USER, rid=user_ids)
-    sql_list.append(sql)
+    sql_s = 'UPDATE `{tp}audit_auz` SET `state`={ph} WHERE `rtype`={ph} AND `rid` IN ({rid});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder, rid=user_ids)
+    sql_v = (state, TP_USER)
+    sql_list.append({'s': sql_s, 'v': sql_v})
 
-    sql = 'UPDATE `{}audit_map` SET u_state={state} WHERE u_id IN ({ids});' \
-          ''.format(db.table_prefix, state=state, ids=user_ids)
-    sql_list.append(sql)
+    sql_s = 'UPDATE `{tp}audit_map` SET `u_state`={ph} WHERE `u_id` IN ({ids});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder, ids=user_ids)
+    sql_v = (state, )
+    sql_list.append({'s': sql_s, 'v': sql_v})
 
     if db.transaction(sql_list):
         return TPE_OK
@@ -663,15 +675,17 @@ def update_fail_count(handler, user_info):
     is_locked = False
     fail_count = user_info.fail_count + 1
 
-    sql = 'UPDATE `{}user` SET fail_count={count} WHERE id={uid};' \
-          ''.format(db.table_prefix, count=fail_count, uid=user_info.id)
-    sql_list.append(sql)
+    sql_s = 'UPDATE `{tp}user` SET `fail_count`={ph} WHERE `id`={ph};' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder)
+    sql_v = (fail_count, user_info.id)
+    sql_list.append({'s': sql_s, 'v': sql_v})
 
     if sys_cfg.login.retry != 0 and fail_count >= sys_cfg.login.retry:
         is_locked = True
-        sql = 'UPDATE `{}user` SET state={state}, lock_time={lock_time} WHERE id={uid};' \
-              ''.format(db.table_prefix, state=TP_STATE_LOCKED, lock_time=tp_timestamp_sec(), uid=user_info.id)
-        sql_list.append(sql)
+        sql_s = 'UPDATE `{tp}user` SET `state`={ph}, `lock_time`={ph} WHERE `id`={ph};' \
+                ''.format(tp=db.table_prefix, ph=db.place_holder)
+        sql_v = (TP_STATE_LOCKED, tp_timestamp_sec(), user_info.id)
+        sql_list.append({'s': sql_s, 'v': sql_v})
 
     if db.transaction(sql_list):
         return TPE_OK, is_locked
@@ -698,24 +712,32 @@ def remove_users(handler, users):
     sql_list = []
 
     # 将用户从所在组中移除
-    sql = 'DELETE FROM `{tpdp}group_map` WHERE type={t} AND mid IN ({ids});' \
-          ''.format(tpdp=db.table_prefix, t=TP_GROUP_USER, ids=str_users)
-    sql_list.append(sql)
+    sql_s = 'DELETE FROM `{tp}group_map` WHERE `type`={ph} AND `mid` IN ({ids});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder, ids=str_users)
+    sql_v = (TP_GROUP_USER, )
+    sql_list.append({'s': sql_s, 'v': sql_v})
+
     # 删除用户
-    sql = 'DELETE FROM `{tpdp}user` WHERE id IN ({ids});'.format(tpdp=db.table_prefix, ids=str_users)
-    sql_list.append(sql)
+    sql_s = 'DELETE FROM `{tp}user` WHERE `id` IN ({ids});'.format(tp=db.table_prefix, ids=str_users)
+    sql_list.append({'s': sql_s, 'v': None})
+
     # 将用户从运维授权中移除
-    sql = 'DELETE FROM `{}ops_auz` WHERE rtype={rtype} AND rid IN ({ids});' \
-          ''.format(db.table_prefix, rtype=TP_USER, ids=str_users)
-    sql_list.append(sql)
-    sql = 'DELETE FROM `{}ops_map` WHERE u_id IN ({ids});'.format(db.table_prefix, ids=str_users)
-    sql_list.append(sql)
+    sql_s = 'DELETE FROM `{tp}ops_auz` WHERE `rtype`={rtype} AND `rid` IN ({ids});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder, ids=str_users)
+    sql_v = (TP_USER, )
+    sql_list.append({'s': sql_s, 'v': sql_v})
+
+    sql_s = 'DELETE FROM `{tp}ops_map` WHERE `u_id` IN ({ids});'.format(tp=db.table_prefix, ids=str_users)
+    sql_list.append({'s': sql_s, 'v': None})
+
     # 将用户从审计授权中移除
-    sql = 'DELETE FROM `{}audit_auz` WHERE rtype={rtype} AND rid IN ({ids});' \
-          ''.format(db.table_prefix, rtype=TP_USER, ids=str_users)
-    sql_list.append(sql)
-    sql = 'DELETE FROM `{}audit_map` WHERE u_id IN ({ids});'.format(db.table_prefix, ids=str_users)
-    sql_list.append(sql)
+    sql_s = 'DELETE FROM `{tp}audit_auz` WHERE `rtype`={ph} AND `rid` IN ({ids});' \
+            ''.format(tp=db.table_prefix, ph=db.place_holder, ids=str_users)
+    sql_v = (TP_USER, )
+    sql_list.append({'s': sql_s, 'v': sql_v})
+
+    sql_s = 'DELETE FROM `{tp}audit_map` WHERE `u_id` IN ({ids});'.format(tp=db.table_prefix, ids=str_users)
+    sql_list.append({'s': sql_s, 'v': None})
 
     if not db.transaction(sql_list):
         return TPE_DATABASE