1

I am in a dilema that how could i writ such sql queries to make a seach. I have tried and posted it, but it not as expected when user enter data in multiple field of a form and make a search.

The query which i wrote form for a single form field and makes a search and display

#!/usr/bin/python

import cgi
import MySQLdb

class Table():

    def __init__(self, host, user, passwd, name):

        self.db = MySQLdb.connect(host = host, user = user, passwd = passwd, db = name)
        self.cursor = self.db.cursor()

    def getdata(self, fname, lname, age, gender):
        self.fname = fname
        self.lname = lname
        self.age = age
        self.gender = gender

    def mysqlconnect(self):

        sql = "select * from PERSON where F_Name = '%s' or L_Name = '%s' or Age = '%s' or Gender = '%s' " %(self.fname, self.lname, self.age, self.gender)
        self.cursor.execute(sql)
        result = self.cursor.fetchall()

        for row in result:
            print "<br>", row[0], row[1], row[2], row[3]

        self.cursor.close()
        self.db.close()


def main():

    print "Content-type: text/html\n"
    tableobj = Table("localhost", "root", "root", "Info")

    form = cgi.FieldStorage()
    f_name = form.getvalue('firstname', '')
    l_name = form.getvalue('lastname', '')
    age = form.getvalue('age', 0)
    gender = form.getvalue('gender', '')

    tableobj.getdata(f_name, l_name, age, gender)
    tableobj.mysqlconnect()

if __name__ == "__main__":
    main()

If suppose user enter data into FirstName field and in the Gender Field

 Firstname: Jeremy
 Gender: male

then it should display the record. If supposer user enter data in Age field and Gender field

Age : 25
Gender: Female

It should display result of fewmale whose age is 25. Likewise all the possible condition

8
  • 2
    Whoah! I hope you didn't put this live on the web because you opened yourself to a SQL injection attack there. Learn about using SQL parameters first! Commented Nov 13, 2013 at 11:19
  • Use sql = "select * from PERSON where F_Name = %s or L_Name = %s or Age = %s or Gender = %s", then self.cursor.execute(sql, (self.fname, self.lname, self.age, self.gender)) instead (no quotes around the %s placeholders, move parameters to second argument of the cursor.execute() call. Commented Nov 13, 2013 at 11:21
  • I am just practicing on my local server.....and whats wrong with the code ? Commented Nov 13, 2013 at 11:22
  • Other than that, you didn't give us anything to go on here. What data do you have? What search criteria did you use? What output did you expect to get, what did you get instead? Commented Nov 13, 2013 at 11:22
  • 1
    So practice doing it right, stops you developing very very very bad habits. Commented Nov 13, 2013 at 11:23

1 Answer 1

1

Jeremy,

To answer your question, Martijn did a great job of explaining here:

sql = "select * from PERSON where F_Name = %s or L_Name = %s or Age = %s or Gender = %s", > then self.cursor.execute(sql, (self.fname, self.lname, self.age, self.gender))

But, in your case, the best idea would be to use an ORM. This would save you a lot of trouble in the long run!

Writing your own SQL queries is fine, however, you open yourself to several problems. SQL-based attacks, as well as just having a harder time parsing your data, are two.

Generic information on ORMs: http://en.wikipedia.org/wiki/Object-relational_mapping

For Python, there are a few good ones. SQlAlchemy is the most known, but look around and see what you need.

Sign up to request clarification or add additional context in comments.

6 Comments

I got it, but what query i should write in my code if in a form multiple fields are filled ??
Well, you can do a few things. You can write a separate query depending on which form values are filled, and parse that with Python before submitting the request. Or, you can use the query Matijn gave you here: > sql = "select * from PERSON where F_Name = %s or L_Name = %s or >Age = %s or Gender = %s", > then self.cursor.execute(sql, (self.fname, self.lname, self.age, self.gender)) That would allow for fname lname age and gender. Or, are you saying you want to match ALL those values? Basically, you'd do an "and" instead of an "or" in your query.
I should have a query for which all the condition should get satisfied. depends on user who can enter data in any form field and makes a search. I need a query and i unable to get to what should i write
I have updated the description. Please check. To what should be the code when certain conditions is been there ?
Well, this is one of the reasons why an ORM would be nice. Look here for an example: peewee.readthedocs.org/en/latest/peewee/… In that case, you could just do multiple .where queries, one for each form field. If the field is blank, just don't run that query.
|

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.