0

I'm trying to display data from table user (in UI via JSON) in a modal and edit on this same modal then commit the changes to my local database.

  $("#users").on('click','.btnSelect',function(){ 
    var currentRow=$(this).closest("tr"); 
    var TableData = new Array();
     TableData={

    'Username': currentRow.find("td:eq(0)").text(), 
    'Email': currentRow.find("td:eq(1)").text(), 
    'Access': currentRow.find("td:eq(2)").text(),
    'ID': currentRow.find("td:eq(3)").text() 
    }
    console.log(JSON.stringify(TableData));

        var html='';


        html += '<form id="form" method="post" data-parsley-validate class="form-horizontal form-label-left">';          
        html += '<div class="form-group" >'; 
        html +='<label class="control-label col-md-3 col-sm-3 col-xs-12" for="username">Username<span class="required">*</span></label>';
        html +='<div class="col-md-6 col-sm-6 col-xs-12">';
        html +='<input type="text" name="username" class="form-control" id="usernameupdated" value="'+TableData.Username+'">';
        html +='</div>';
        html +='</div>';
        html += '<div class="form-group" >'; 
        html +='<label class="control-label col-md-3 col-sm-3 col-xs-12" for="email">Email<span class="required">*</span></label>';
        html +='<div class="col-md-6 col-sm-6 col-xs-12">';
        html +='<input type="text" name="email" class="form-control" id="emailupdated"value="'+TableData.Email+'">';
        html +='</div>';
        html +='</div>';
        html += '<div class="form-group" >'; 
        html +='<label class="control-label col-md-3 col-sm-3 col-xs-12" for="access">Access<span class="required">*</span></label>';
        html +='<div class="col-md-6 col-sm-6 col-xs-12">';
        html +='<input type="text" name="access" class="form-control" id="accessupdated" value="'+TableData.Access+'">';
        html +='</div>';
        html +='</div>';        
        html +='</form>';


        $('#save').on('click', function() {

            ID=TableData.ID;
            email = document.getElementById('emailupdated').value;
            username = document.getElementById('usernameupdated').value;
            access = document.getElementById('accessupdated').value;

            console.log(username)
            console.log(typeof(username))
            console.log(email)
            console.log(access)
            console.log(ID)


              $.ajax({
                type: 'POST',
                url: '/update',
                data: {
                  'username': username,
                  'email': email,
                  'access': access,
                  'ID': ID,
               },
                error: function(e) {
                console.log(e);
                }

            })


    });

   $('#myForm').html(html); 

});
@app.route('/update', methods=['POST'])
def updateuser():
    db = DB.DBLayer()
    dbsession = db.getSession()
    dbcursor = db.getCursor()
    list_Members=db.getMembers()
    list_customers=db.getCustomers()
    if request.method =='POST':
        newusername = request.args.get('username')

        newemail =request.args.get('email')

        newaccess = request.args.get('access')

        ID=request.args.get('ID')

        sql= 'UPDATE user SET username="'+newusername+'" and email="'+newemail+'" and access="'+newaccess+'" WHERE id="'+ID+'";'
        dbcursor.execute( sql)
    return render_template('success.html',list_Members=list_Members,list_customers=list_customers)
davidism
  • 121,510
  • 29
  • 395
  • 339
amalkh
  • 11
  • 6

1 Answers1

0

You should use JSON, you are not getting the data properly, thats why newusername etc. are None.

In your AJAX use JSON.stringify:

data : JSON.stringify({
                  'username': username,
                  'email': email,
                  'access': access,
                  'ID': ID,
               }),
contentType: 'application/json;charset=UTF-8',

In python use JSON to load the data:

import json
data_received = json.loads(request.data)

Now you can use the data:

print (data_received['username'])

To avoid SQL injection, replace your SQL with a paremtrized query.

sql = 'UPDATE user SET username = ?, email = ?, access = ? WHERE id = ?'
db.execute(sql, (data_received['username'], data_received['email'], data_received['access'], data_received['id']))
davidism
  • 121,510
  • 29
  • 395
  • 339
Roman
  • 3,563
  • 5
  • 48
  • 104
  • thanks for your answer :) but now i'm getting a new error : raise ValueError("No JSON object could be decoded") ValueError: No JSON object could be decoded – amalkh Apr 05 '18 at 10:31
  • I forgot, you also need to add: `contentType: 'application/json;charset=UTF-8'`. I updated the answer. – Roman Apr 05 '18 at 10:46
  • getting this when i tried the new sql : query = query % tuple([db.literal(item) for item in args]) TypeError: not all arguments converted during string formatting – amalkh Apr 05 '18 at 13:43