Displaying data on new page in Python

Question

I want to display each row from a database in a <td> in the following index.html page:

$def with(items)
<h1></h1>
<br/>
<br>
<table border="1">
    <tr>
        <th>Name</th>
        <th>address</th>
        <th>number</th>
    </tr>

    <tr>
        <td>//want name here</td>
        <td>//address here</td>
        <td>//number here</td>
    </tr>
</table>

app.py code:

import web
import MySQLdb

urls = (
  '/', 'Index'
)

app = web.application(urls, globals())

render = web.template.render('templates/')

class Index(object):
    def GET(self):
        return render.hello_form()

    def POST(self):
            form = web.input(name="a", newname="s", number="d")
            conn = MySQLdb.connect(host= "localhost", user="root", passwd="", db="testdb")
            x = conn.cursor()
            x.execute("SELECT * FROM details  WHERE name = '%s'" % (form.name))
            conn.commit()
            items = x.fetchall()
            for row in items: 
                conn.rollback()
                conn.close()
                return render.index(items)
    if __name__ == "__main__":
        app.run()

what happens if name = `' union select concat(login, ':', password) from users where user='admin`? (yes, that's pseudo code) See https://www.owasp.org/index.php/SQL_Injection — Aif, Sep 30 '16 at 08:29

Himani Agrawal · Accepted Answer · 2016-09-30T08:13:06.570

1

items (results fetched) will be an array of tuples. Return the array as it is as you want to display whole data on the html and HTML is only rendered once.

app.py code

import web
import MySQLdb

urls = (
  '/', 'Index'
)

app = web.application(urls, globals())

render = web.template.render('templates/')

class Index(object):
    def GET(self):
        return render.hello_form()

def POST(self):
        form = web.input(name="a", newname="s", number="d")
        conn = MySQLdb.connect(host= "localhost", user="root", passwd="", db="testdb")
        x = conn.cursor()
        x.execute("SELECT * FROM details  WHERE name = '%s'" % (form.name))
        items = x.fetchall()       
        conn.close()
        return render.index(items) // return the array of results as a whole
if __name__ == "__main__":
    app.run()

On index.html

$def with(items)
<h1></h1>
<br/>
<br>
<table border="1">
    <tr>
        <th>Name</th>
        <th>address</th>
        <th>number</th>
    </tr>
   $for row in items: 
        <tr>
        <td>$row[0]</td>
        <td>$row[1]</td>
        <td>$row[2]</td>
        </tr>
</table>

Iterate over the items and display them

edited Sep 30 '16 at 08:13

answered Sep 30 '16 at 07:04

Himani Agrawal

1,242
12
14

its not displaying anything its just showing a blank page – Edison Augusthy Sep 30 '16 at 07:16
Try checking is data is fetched or not. Try printing items after it is fetched in app.py and render a different template which will print all the items as it is. To render new template do: `$def with (items) $items` – Himani Agrawal Sep 30 '16 at 07:22
i think data is not fetched so what should i do am totally new in python – Edison Augusthy Sep 30 '16 at 07:28
What does print items in app.py print ? If doesnot print anything there is problem with MYSQL connection or query. Check this answer http://stackoverflow.com/a/622308/5027503 – Himani Agrawal Sep 30 '16 at 07:41
it was printing when i gave `$item` but it was mixed all together so i dont think there is a problem in sql – Edison Augusthy Sep 30 '16 at 08:06
iterate over items then, each will result in row. now set $row[0]. Try this. – Himani Agrawal Sep 30 '16 at 08:14
i just added 'for row in items:' after fetch all...now its working thank you so much@Himani Agrawal – Edison Augusthy Sep 30 '16 at 08:24

Displaying data on new page in Python

1 Answers1