473,408 Members | 1,980 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,408 software developers and data experts.

modifying html input date for mysql, reg ex or string interpolation?

Kun
I have an html form that takes dates and inserts them into a mysql file.
Currently, users have to type in dates in the yyyy-mm-dd format. As
of now, this process works with the sql. However, I would like to make
this process easier by:

1) providing drop down menus for year, month, and date respectively.
in a failed attempt, i tried made 3 drop down lists (dateyear,
datemonth, dateday) respectively and then used string interpolation to
tie them together into a yyyy-mm-dd string called 'date'. I then tried
to use this 'date' string in my original sql query and it no longer worked.

Is this because the new 'date' value is a string instead of an int? How
can I go about solving this problem and making the new 'date' string
work with my old sql query?
Attached is my code:
#!/usr/bin/env python

import cgi
print "Content-type: text/html"
print

form = cgi.FieldStorage()
print form.keys()
#gets value for each input
price = form["price"]
price = price.value
purchasetype = form["purchasetype"]
purchasetype = purchasetype.value
date = form["date"]
date = date.value
comment = form["comment"]
comment = comment.value
dateyear = form["dateyear"]
dateyear = dateyear.value
datemonth = form["datemonth"]
datemonth = datemonth.value
dateday = form["dateday"]
dateday = dateday.value
#string interpolation for date
date = "%d-%d-%d" % (dateyear, datemonth, dateday)
print "<br>"

for x in form.keys():
print "%s=%s" % (x, form[x].value) + "<br>"
# make connection to MySQL
import MySQLdb
import re
import urllib
import sys

try:
connection = MySQLdb.connect(host="localhost", user="xxxx",
passwd="xxxx", db ="xxxx")

except MySQLdb.Error, e:
print "Error %d: %s" % (e.args[0], e.args[1])
sys.exit (1)

#take data and put it into table that you have created.
cursor = connection.cursor()
mysqlstatement = ""
mysqlstatement = "INSERT INTO dir (date, purchasetype, price, comment)
VALUES ('"+ date +"','"+ purchasetype +"','"+ price +"','"+ comment +"' )"
print mysqlstatement
cursor.execute (mysqlstatement)
Apr 11 '06 #1
2 2923
Kun <ne*******@gmail.com> writes:
[...]
mysqlstatement = "INSERT INTO dir (date, purchasetype, price, comment)
VALUES ('"+ date +"','"+ purchasetype +"','"+ price +"','"+ comment +"' )"

[...]

Haven't read your post carefully, but the first thing that jumps out
at me is that you should be using SQL parameter interpolation, not
Python string formatting.

sql = ("INSERT INTO dir (date, purchasetype, price, comment) "
"VALUES (%s, %s, %s, %s)")
cursor.execute(sql, (date, purchasetype, price, comment))
Google for "SQL injection" to see why this is a nasty security issue,
not just a matter of practical coding convenience.
John

Apr 11 '06 #2
Kun <ne*******@gmail.com> writes:
[...]
for x in form.keys():
print "%s=%s" % (x, form[x].value) + "<br>"

[...]

....and the second thing that jumps out at me is that you're neglecting
to HTML-quote the data you're inserting into your web page here (for
example, using xml.sax.saxutils.escape()), which is another common
cause of security holes, very similar to those with failing to use
proper SQL parameter quoting.

Google for "cross-site scripting".
John

Apr 12 '06 #3

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

0
by: James Hong | last post by:
Help please, I try to sending an email from my html page using the java applet. but it give error on most of the PC only very few work, what is the error i make the java applet show as below ...
6
by: Raqueeb Hassan | last post by:
Hello There! Have you guys tried inserting variables in mySQL tables? Do I have to use 'quote' as we had been doing to insert strings? mysql> INSERT INTO occurrence (word_id,page_id) VALUES...
0
by: JMCN | last post by:
hi i'm trying to create an input box that will ask the users for the date (LW_Date)and then, open up the pass-through query with the specific date results from the input box. i typed in the date...
7
by: | last post by:
Hello, I would like to do the following from a asp.net button click: <form method="POST" action="https://www.1234.com/trans_center/gateway/direct.cgi"> <input type="hidden" name="Merchant"...
18
by: pkassianidis | last post by:
Hello everybody, I am in the process of writing my very first web application in Python, and I need a way to generate dynamic HTML pages with data from a database. I have to say I am...
0
by: MonkeeSage | last post by:
There are several string interpolation functions, as well as string.Template. But here's yet another. This one emulates ruby's inline interpolation syntax (using #{}), which interpolates strings as...
14
by: jcage | last post by:
Is there any tutorials online for sending email through forms? I can send an email as well as write to my MySQL database from home with the following code but not at work. I think there might be...
14
by: micky125 | last post by:
Lo all, Had me head wrecked the whole week with a really stupid problem that came down to me not reading something but now when im running the php file i have errors switched on and i have bout 15...
0
by: brianrpsgt1 | last post by:
I am attempting to insert data from a HTML form using a .psp script. I can not find how to link the data that is inserted into the form to the variables in the .psp script to then insert into the...
0
BarryA
by: BarryA | last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
1
by: Sonnysonu | last post by:
This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...
0
by: Hystou | last post by:
There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
0
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...
0
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...
0
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...
0
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...
0
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing,...
0
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.