0

I am having a problem with WTForms in Flask, I want to create a add_menu function which adds menu to the database. User can choose from SelectField "Appetizer", "Main Dish", or "Drinks" accordingly. So whenever user chooses the value from SelectField it adds to the corresponding table in a database. (I use MySQL). For some reason when I use menu_type = form.menu_type.data it gives me the following error

mysql_exceptions.ProgrammingError: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''main_dishes'(name,ingredients,price) VALUES('Salmon', '

duude,frv

', '35')' at line 1") It takes the right value, but I have this awkward '' signs infront of main_dishes string My code looks as follows: 
class MenuForm(Form):
    menu_type = SelectField('Menu Type', [validators.DataRequired()], choices=[('appetizers','Appetizer'),('main_dishes','Main Dish'),('desserts','Dessert'),('drinks','Drinks')], coerce=str)
    name = StringField('Name', [validators.Length(min=1, max=2000)])
    ingredients = TextAreaField('Ingredients', [validators.Length(min=10)])
    price = DecimalField('Price (Manat)', [validators.DataRequired()])

@app.route('/add_menu', methods=['GET','POST'])
@is_logged_in
def add_menu():
    form = MenuForm(request.form)
    if request.method == 'POST' and form.validate():
        menu_type = form.menu_type.data # <---Here is the problem
        name = form.name.data
        ingredients = form.ingredients.data
        price = form.price.data

        #Create cursor
        cur = mysql.connection.cursor()

        #execute
        cur.execute("INSERT INTO %s(name,ingredients,price) VALUES(%s, %s, %s)", (menu_type,name,ingredients,price))

        #Commit to DB
        mysql.connection.commit()

        #CLose connection
        cur.close()

        flash('Menu is Added', 'success')

    return redirect(url_for('dashboard'))

return render_template('add_menu.html', form=form)
BAT
  • 188
  • 1
  • 19

1 Answers1

1

The table name is substituted as a quoted string and the query executed as such.

You may want to build your query with the table name before binding parameterized values.

query = "INSERT INTO {}(name,ingredients,price) VALUES(%s, %s, %s)".format(menu_type)
cur.execute(query, (name,ingredients,price))
Oluwafemi Sule
  • 36,144
  • 1
  • 56
  • 81