2014-01-15 121 views
2

這是一個非常基本的問題,我知道這個代碼存在安全問題,它應該使用其他問題中的參數化條目 - 這是一項正在進行的工作。我正在嘗試爲項目設置構建用戶註冊模塊。我建立了一個表,其中第一列充當具有主鍵約束的ID,但是當我運行代碼時,出現以下錯誤,我不知道爲什麼 - (如果它涉及p_ID列):sqlite3.OperationalError:沒有這樣的列:

Traceback (most recent call last): 
    File "user.py", line 72, in <module> 
    userSignUp() 
    File "user.py", line 68, in userSignUp 
    c.execute("INSERT INTO People VALUES(userName, password, confirmPassword, firstName,lastName, companyName, email, phoneNumber,addressLine1, addressLine2, addressLine3, zipCode, province, country, regDate)") 
sqlite3.OperationalError: no such column: userName 

的代碼是:

import sqlite3 
import datetime 


path = "/Users/workhorse/thinkful/" 
db = "apartment.db" 

def checkAndCreateDB(): 
    #not checking for some reason 
    #fullPath = os.path.join(path, db) 
    #if os.path.exists(fullPath): 
    # print "Database Exists" 
    #else: 
    connection = sqlite3.connect(db) 
    print "Creating database" 
    createUserRegTable() 

def createUserRegTable(): 
    with sqlite3.connect(db) as connection: 
     c = connection.cursor() 
     c.execute("""CREATE TABLE People 
     (p_ID INTEGER PRIMARY KEY AUTOINCREMENT, 
     userName TEXT NOT NULL UNIQUE, 
     password TEXT NOT NULL, 
     confirmPassword TEXT NOT NULL, 
     firstName TEXT NOT NULL, 
     lastName TEXT NOT NULL, 
     companyName TEXT NOT NULL, 
     email TEXT NOT NULL UNIQUE, 
     phoneNumber TEXT NOT NULL, 
     addressLine1 TEXT NOT NULL, 
     addressLine2 TEXT, 
     addressLine3 TEXT, 
     zipCode TEXT NOT NULL, 
     province TEXT NOT NULL, 
     country TEXT NOT NULL, 
     regDate DATE NOT NULL) 
     """) 
     print "table made" 


def userSignIn(): 
    pass 

def userSignUp(): 
    userName = raw_input("Enter a user name: ") 
    password = raw_input("Enter a password: ") 
    confirmPassword = raw_input("Confirm Your Password: ") 
    firstName = raw_input("Enter your first name: ") 
    lastName = raw_input("Enter your last name: ") 
    companyName = raw_input("Enter your company name: ") 
    email = raw_input("Enter your email: ") 
    phoneNumber = raw_input("Enter your phone number: ") 
    addressLine1 = raw_input("Enter your address: ") 
    addressLine2 = raw_input("Enter second line of your address (Not Required): ") 
    addressLine3 = raw_input("Enter third line of your address (Not Required): ") 
    zipCode = raw_input("Enter your zip code: ") 
    province = raw_input("Enter your state or province: ") 
    country = raw_input("Enter your country: ") 
    regDate = datetime.date.today() 
    print regDate 

    #userInfo = (userName, password, confirmPassword, firstName,lastName, companyName, email, phoneNumber,addressLine1, 
    #addressLine2, addressLine3, zipCode, province, country, regDate) 

    with sqlite3.connect(db) as connection: 
     c = connection.cursor() 
     c.execute("INSERT INTO People VALUES(userName, password, confirmPassword, firstName,lastName, companyName, email, phoneNumber,addressLine1, addressLine2, addressLine3, zipCode, province, country, regDate)") 

checkAndCreateDB() 

userSignUp() 

由於大部分

回答

7

如果要插入的Python值到一個SQL數據庫,只需命名的Python變量在SQL語句不夠。 SQL數據庫改爲想要插入從表或其他查詢中取出的值。

使用SQL parameters代替,並且通過在實際值:

params = (userName, password, confirmPassword, firstName, lastName, 
      companyName, email, phoneNumber, addressLine1, addressLine2, 
      addressLine3, zipCode, province, country, regDate) 

c.execute("INSERT INTO People VALUES (NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", params) 

NULL值是p_ID主鍵列;另一種方法是爲所有要爲其插入值的列命名。

+0

非常感謝,我第一次設置腳本時設置了參數 - 這是第一個拋出我的參數。 –

+0

如前所述,替代方法是使用INSERT INTO People(用戶名,密碼,confirmPassword,要爲其插入值的所有列名稱)VALUES(?,?,< 。但是這有點冗長。使用'NULL'讓SQLite插入默認值會更容易。 –

0

Martijn的答案很好,但如果你知道某個值將會是NULL,那麼這個答案很有用。但是,如果任何變量可能爲NULL,我使用了一個稍微不同的實現。

將任何變量設置爲無。如果您瀏覽您的數據庫,該值將爲空,並且它將在Python控制檯中顯示爲無,因爲它們是等效的。

見節11.13.5.1的文件(https://docs.python.org/2/library/sqlite3.html)中:

Python類型無= SQLite的類型NULL

0

正如我沒有在db.sqlite3具有任何重要的數據。

我修復了我的問題,刪除了db.sqlite3並運行以下命令。

python manage.py migrate 
相關問題