Re: TypeError

John Machin wrote:
On Jan 7, 1:38 pm, Steve Holden <st...@xxxxxxxxxxxxx> wrote:
John Machin wrote:

[...]> I note that in the code shown there are examples of building an SQL
query where the table name is concocted at runtime via the %
operator ... key phrases: "bad database design" (one table per
store!), "SQL injection attack"
I'm not trying to defend the code overall, but most databases won't let
you parameterize the table or column names, just the data values.

That's correct, and that's presumably why the OP is constructing whole
SQL statements on the fly e.g.

cursor.execute('select max(ID) from %sCustomerData;' % store)

Well yes, but that is just a symptom of the real disease, which is that
he has very little idea what he is doing.

What is the reason for "but" in "but most databases won't ..."? What
are you rebutting?

I was simply pointing out that the OP had chosen the only available way
of generating variable table names. The bad database design has been
discussed,if not ad infinitum then certainly ad nauseam. All advice has
been ignored.

Let me try again: One table per store is bad design. The
implementation of that bad design may use:

cursor.execute('select max(ID) from %sCustomerData;' % store)
or (if available)
cursor.execute('select max(ID) from ?CustomerData;', (store, ))
but the implementation means is irrelevant.

[Do you know any database on which the latter technique will work? I
realise I said "most", but I suspect I should have said "all" - at least
I can't think of a counterexample now I have put myself on the spot].

I pointed this out to the OP some time ago. It won't make any
difference. In the particular code you mention the tables didn't seem to
be constructed from user input, thereby removing much of the danger of
SQL injection exploits, but I could be wrong - reading it made me feel
squeamish so I didn't analyze it thoroughly.

The whole thing is a hodge-podge of Python and HTML produced by an
individual who appears to feel it isn't necessary to understand either
HTTP or HTML in order to produce dynamic web sites, whose grasp of
Python itself is slight and whose response to constructive criticism is
to defer acting on it until it is no longer going to be helpful.

regards
Steve
--
Steve Holden +1 571 484 6266 +1 800 494 3119
PyCon is coming! Atlanta, Feb 2010 http://us.pycon.org/
Holden Web LLC http://www.holdenweb.com/
UPCOMING EVENTS: http://holdenweb.eventbrite.com/

.

Relevant Pages

  • Re: TypeError
    ... > I note that in the code shown there are examples of building an SQL ... "bad database design" (one table per ... cursor.executefrom %sCustomerData;' % store) ... One table per store is bad design. ...
    (comp.lang.python)
  • Re: Problems with querying date field
    ... >> If you want to put a database somewhere for safekeeping, ... database - SQL isn't about persistence, ... says nothing about the physical storage media to be used. ... store data on a tape, or a disk, or a CD, or a file, or any physical ...
    (microsoft.public.sqlserver.programming)
  • Re: Should I place a Domain controller in each of the 40 stores?
    ... They should be able to do that, one common way is to use a SQL account in an mixed SQL authentication enviroment where the Apps use a dedicated local SQL account to connect to the DB, but again the app may work differently. ... Also note that although it is possible, it's NOT recommended to cluster for example a SQL server that is also a DC. ... We plan to place a SQL server in each store as part of a new POS ... implementation and also migrate to XP Embedded for the POS terminals. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Need Aggregate Query Help!!!
    ... else than what I am suggesting. ... I was using Access SQL with JET backend. ... (SELECT EmpName, Store, SUM(Qty) ... GROUP BY EmpName, Store) as B ...
    (microsoft.public.access.queries)
  • Re: Something More Elegant
    ... c.CategoryID=%s;' % (store, store, categoryID) ... sql = 'select distinct p.ID from %sPackages p join ... distinct p.ID from productsPackages p join productsCategoriesPackages c ... query = 'select distinct p.ID from productsPackages p join ...
    (comp.lang.python)