0

I am a beginner with Flask, Psycopg2, and Python and I have this little problem, I have created an input() variable that reads users' answer and I want that answer to be put into my databases tables specific column.

print('Are the eyes Open or Closed?: ')
estate1 = input()

def update_Eyes(self):
update_command = ("UPDATE Eyes SET cstate=%s Where id=1", (estate1,))
self.cursor.execute(update_command)
print("Eye table update successful ")

database_connection = DatabaseConnection()
database_connection.update_Eyes()

If I try to add any values myself, it works just fine but I can't seem to find a solution to adding a variable.

The error code looks like this:

Traceback (most recent call last):
File "C:/Users/AJ/Desktop/Data Processing/Flask/first.py", line 136, in <module>
database_connection.update_Eyes()  # Updates Table Eyes
File "C:/Users/AJ/Desktop/Data Processing/Flask/first.py", line 98, in update_Eyes
self.cursor.execute(update_command)
TypeError: argument 1 must be a string or unicode object: got tuple instead

2 Answers 2

0

When you're compiling your command into update_command you are storing this as a Tuple:

estate1 = 'test'
update_command = ("UPDATE Eyes SET cstate=%s Where id=1", (estate1,))
print(type(update_command))

<type 'tuple'>

The error is saying that its expecting a String. So, change update_command to:

update_command = "UPDATE Eyes SET cstate = '{0}' Where id=1".format(estate1)

After the change, you'll see something like this:

update_command = "UPDATE Eyes SET cstate = '{0}' Where id=1".format(estate1)
print(type(update_command))
<type 'str'>

If you're worried about SQL Injection, you can visit this explanation of how to handle user input correctly.

1
  • @Abelisto, Sure mate, have updated the answer with a link to escaping characters correctly.
    – ditrapanij
    Commented Apr 12, 2020 at 11:19
0

That is a perfect solution

update_command = "UPDATE Eyes SET cstate = '{0}' Where id=1".format(estate1)

I just had to add extra quotation marks around '{0}' to make it read strings and it works perfectly fine. Thank you so much. :)

3
  • What if the estate1 value contains the quotation character? "foo '{0}'".format("a'b") Or, moreover, somebody enters something like a' ; drop table Eyes; commit;? (It is called "SQL injection", search for this term)
    – Abelisto
    Commented Apr 12, 2020 at 11:08
  • This user input should be a sensor in an autonomous vehicle, no data regarding the customer would be placed there. It is only to prevent the driver from falling asleep or just monitoring. but that is a good point I will definitely look into that! :) Commented Apr 12, 2020 at 11:18
  • In any case self.cursor.execute("UPDATE Eyes SET cstate=%s Where id=1", (estate1,)) is simpler and safer. Good luck!
    – Abelisto
    Commented Apr 12, 2020 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.