2014-01-15 172 views
2

这是一个非常基本的问题,我知道这个代码存在安全问题,它应该使用其他问题中的参数化条目 - 这是一项正在进行的工作。我正在尝试为项目设置构建用户注册模块。我建立了一个表,其中第一列充当具有主键约束的ID,但是当我运行代码时,出现以下错误,我不知道为什么 - (如果它涉及p_ID列):sqlite3.OperationalError:没有这样的列:

Traceback (most recent call last): 
    File "user.py", line 72, in <module> 
    userSignUp() 
    File "user.py", line 68, in userSignUp 
    c.execute("INSERT INTO People VALUES(userName, password, confirmPassword, firstName,lastName, companyName, email, phoneNumber,addressLine1, addressLine2, addressLine3, zipCode, province, country, regDate)") 
sqlite3.OperationalError: no such column: userName 

的代码是:

import sqlite3 
import datetime 


path = "/Users/workhorse/thinkful/" 
db = "apartment.db" 

def checkAndCreateDB(): 
    #not checking for some reason 
    #fullPath = os.path.join(path, db) 
    #if os.path.exists(fullPath): 
    # print "Database Exists" 
    #else: 
    connection = sqlite3.connect(db) 
    print "Creating database" 
    createUserRegTable() 

def createUserRegTable(): 
    with sqlite3.connect(db) as connection: 
     c = connection.cursor() 
     c.execute("""CREATE TABLE People 
     (p_ID INTEGER PRIMARY KEY AUTOINCREMENT, 
     userName TEXT NOT NULL UNIQUE, 
     password TEXT NOT NULL, 
     confirmPassword TEXT NOT NULL, 
     firstName TEXT NOT NULL, 
     lastName TEXT NOT NULL, 
     companyName TEXT NOT NULL, 
     email TEXT NOT NULL UNIQUE, 
     phoneNumber TEXT NOT NULL, 
     addressLine1 TEXT NOT NULL, 
     addressLine2 TEXT, 
     addressLine3 TEXT, 
     zipCode TEXT NOT NULL, 
     province TEXT NOT NULL, 
     country TEXT NOT NULL, 
     regDate DATE NOT NULL) 
     """) 
     print "table made" 


def userSignIn(): 
    pass 

def userSignUp(): 
    userName = raw_input("Enter a user name: ") 
    password = raw_input("Enter a password: ") 
    confirmPassword = raw_input("Confirm Your Password: ") 
    firstName = raw_input("Enter your first name: ") 
    lastName = raw_input("Enter your last name: ") 
    companyName = raw_input("Enter your company name: ") 
    email = raw_input("Enter your email: ") 
    phoneNumber = raw_input("Enter your phone number: ") 
    addressLine1 = raw_input("Enter your address: ") 
    addressLine2 = raw_input("Enter second line of your address (Not Required): ") 
    addressLine3 = raw_input("Enter third line of your address (Not Required): ") 
    zipCode = raw_input("Enter your zip code: ") 
    province = raw_input("Enter your state or province: ") 
    country = raw_input("Enter your country: ") 
    regDate = datetime.date.today() 
    print regDate 

    #userInfo = (userName, password, confirmPassword, firstName,lastName, companyName, email, phoneNumber,addressLine1, 
    #addressLine2, addressLine3, zipCode, province, country, regDate) 

    with sqlite3.connect(db) as connection: 
     c = connection.cursor() 
     c.execute("INSERT INTO People VALUES(userName, password, confirmPassword, firstName,lastName, companyName, email, phoneNumber,addressLine1, addressLine2, addressLine3, zipCode, province, country, regDate)") 

checkAndCreateDB() 

userSignUp() 

由于大部分

回答

7

如果要插入的Python值到一个SQL数据库,只需命名的Python变量在SQL语句不够。 SQL数据库改为想要插入从表或其他查询中取出的值。

使用SQL parameters代替,并且通过在实际值:

params = (userName, password, confirmPassword, firstName, lastName, 
      companyName, email, phoneNumber, addressLine1, addressLine2, 
      addressLine3, zipCode, province, country, regDate) 

c.execute("INSERT INTO People VALUES (NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", params) 

NULL值是p_ID主键列;另一种方法是为所有要为其插入值的列命名。

+0

非常感谢,我第一次设置脚本时设置了参数 - 这是第一个抛出我的参数。 –

+0

如前所述,替代方法是使用INSERT INTO People(用户名,密码,confirmPassword,要为其插入值的所有列名称)VALUES(?,?,< 。但是这有点冗长。使用'NULL'让SQLite插入默认值会更容易。 –

0

Martijn的答案很好,但如果你知道某个值将会是NULL,那么这个答案很有用。但是,如果任何变量可能为NULL,我使用了一个稍微不同的实现。

将任何变量设置为无。如果您浏览您的数据库,该值将为空,并且它将在Python控制台中显示为无,因为它们是等效的。

见节11.13.5.1的文件(https://docs.python.org/2/library/sqlite3.html)中:

Python类型无= SQLite的类型NULL

0

正如我没有在db.sqlite3具有任何重要的数据。

我修复了我的问题,删除了db.sqlite3并运行以下命令。

python manage.py migrate 
相关问题