Python 2.7.10 : How can i stop the user exploiting input by entering equation instead of integer?

Question

x2 = (randint(0, 1000000))
y2 = (randint(0, 1000000))

ans2 = input("2. Answer to " + str(x2) + "-" + str(y2))
if ans2 ==  x2 - y2:
  print("Correct!")
  CorrectAns = CorrectAns + 1
else:
  print("Wrong!")

My goal: to ask question i.e 1-1 without user inputting 2-2 and getting it correct

Dilemna: if the person wrote 2-2 when asked, which is 0, which is also the answer to 1-1, the computer thinks it is correct. How do i prevent this?

Don't use `input()` *at all*. Only allow integer input, see duplicate. — Martijn Pieters, Feb 15 '18 at 19:17

score 4 · Accepted Answer · answered Feb 15 '18 at 19:15

4

input(...) is equivalent to eval(raw_input(...)) in Python 2, so you are evaluating what the user typed in. For example, the input '10 - 3' becomes 7 after evaluation.

Get the user input as a string with raw_input, convert the string to an integer using the int builtin and then check against x2 - y2.

answered Feb 15 '18 at 19:15

timgeb

76,762
20
123
145

How do i convert the string with int builting? – AlexTerm Feb 15 '18 at 19:18
I had a crash course in Python now so I now know how to int builting works. Thanks for the answer! – AlexTerm Jul 30 '18 at 19:21

Patrick Artner · Answer 2 · 2018-02-15T19:24:44.377

1

Get the input as raw input and compare it to the stringversion of the result:

from  random import randint
x2 = (randint(0, 1000000))
y2 = (randint(0, 1000000))

ans2 = raw_input("2. Answer to " + str(x2) + "-" + str(y2))
if ans2 ==  str(x2 - y2):
  print("Correct!")
  CorrectAns = CorrectAns + 1
else:
  print("Wrong!")

This way they can still input the calculation you presented them, but it wont be evaluated to a number anymore. By comparing str with str they must match the exact result and you get around try: except: that you need to guards against textinputs if you convert the input to a number for comparison.

With conversion is more lenient:

from  random import randint

CorrectAns = 0

x2 = (randint(0, 1000000))
y2 = (randint(0, 1000000))

ans2 = raw_input("2. Answer to " + str(x2) + "-" + str(y2)+"\n")
try: 
    ansNum = int(ans2)    
    if ansNum ==  x2 - y2:
      print("Correct!")
      CorrectAns = CorrectAns + 1
    else:
      print("Wrong!")
except ValueError:   # catch conversion errors if other things than int inputted
    print("Wrong")

edited Feb 15 '18 at 19:24

answered Feb 15 '18 at 19:17

Patrick Artner

50,409
9
43
69

1

Don't convert the `x2 - y2` result to a string, convert the `ans2` string to an integer. Otherwise whitespace around, or a `+` before, or whitespace between a sign and the correct answer would be seen as incorrect. – Martijn Pieters Feb 15 '18 at 19:19
@MartijnPieters agreed. but by comparing against string you avoid having to guard against malicious textinputs of "fourtytwo" - its strict and converting to int is more comfortable though. – Patrick Artner Feb 15 '18 at 19:20
@MartijnPieters convinced. added the second version as well. – Patrick Artner Feb 15 '18 at 19:26
You don't have to guard against malicious text inputs. `raw_input()` returns a string, always, and **that's it**. You then use `try: intvalue = int(ans2)`, `except ValueError: # tell user to use integers only, loop or abort`. There is no possibility of abuse here. – Martijn Pieters Feb 15 '18 at 19:26
@MartijnPieters You can avoid Try/Except if you do not convert text to int at all. It will simply output wrong in case of "fourtytwo" inputs. With conversion and exceptionhandling is better - I added it already. – Patrick Artner Feb 15 '18 at 19:27

Python 2.7.10 : How can i stop the user exploiting input by entering equation instead of integer?

2 Answers2