How to pass variables in python flask to mysqldb?

Question

Code in .py file:

cur = mysql.connection.cursor()
# Check if this user had voted for somebody
is_voted = cur.execute("SELECT TUTOR_VOTED FROM USERS WHERE USERNAME="+str(session["username"]))

session["username"] keep a user cookie. The user I already logged in names "admin"

But there might be something wrong with the MySQL command inside is_voted

Error:

MySQLdb._exceptions.OperationalError: (1054, "Unknown column 'admin' in 'where clause'")

But I got the correct return value while using

SELECT TUTOR_VOTED FROM USERS WHERE USERNAME='admin'

Is there anything wrong with my input format inside is_voted?

is_voted=cur.execute("SELECT TUTOR_VOTED FROM USERS WHERE USERNAME= ?",(session["username"])) , can you try this and let me know the result — Preetham
– Preetham, Commented May 4, 2019 at 6:31
Another error happens when using this line. Error：MySQLdb._exceptions.ProgrammingError: not all arguments converted during bytes formatting — Yiling Liu
– Yiling Liu, Commented May 4, 2019 at 6:39
then the parameter needs to be converted to string, is_voted=cur.execute("SELECT TUTOR_VOTED FROM USERS WHERE USERNAME= ?",str((session["username"]))) — Preetham
– Preetham, Commented May 4, 2019 at 6:43
It still gets error, but the following answeris_voted = cur.execute("SELECT TUTOR_VOTED FROM USERS WHERE USERNAME='%s'" % str(session["username"])) works — Yiling Liu
– Yiling Liu, Commented May 4, 2019 at 6:45

Huy Ngo · Accepted Answer · 2019-05-04 06:40:52Z

1

Your output string of the combination "SELECT TUTOR_VOTED FROM USERS WHERE USERNAME="+str(session["username"]) misses couple of single quote ''. You can change it to:

is_voted = cur.execute("SELECT TUTOR_VOTED FROM USERS WHERE USERNAME='%s'" % str(session["username"]))

answered May 4, 2019 at 6:40

Huy Ngo

3821 silver badge8 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Preetham Over a year ago

This will surely the better answer but its sort of open to attacks.SQLinjection

Huy Ngo Over a year ago

Yeah, sure that's it's not the best practice for code in production. But I think it's a different story as some cases people may like to see result as quick as possible

Yiling Liu Over a year ago

Thank you so much, I really don't know this kind of attack. Should I write a function to check the username to avoid SQL injection?

Huy Ngo Over a year ago

It is a long story. You can find some ideas here github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/…

Collectives™ on Stack Overflow

How to pass variables in python flask to mysqldb?

1 Answer 1

4 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Linked

Related