FLASK mysqlsserver connection complex

Question

Salutation to all python and flask developers I am trying to create an app in flask which registration isnt working 1 the main app

from flaskext.mysql import MySQL
app = Flask(__name__,static_url_path='/static')

mysql= MySQL()
app.config['MYSQL_DATABASE_USER'] = 'root'
app.config['MYSQL_DATABASE_PASSWORD'] = 'Nimnam*7'
app.config['MYSQL_DATABASE_DB'] = 'store'
app.config['MYSQL_DATABASE_HOST'] = '127.0.0.1'
mysql.init_app(app)
conn = mysql.connect()


@app.route('/')

def hello_world():
    return render_template('home.html')


@app.route('/signup/', methods=['GET','POST'])
def registeruser():
    if request.method == 'POST':
        cursor = conn.cursor()
        firstname= request.form.get('firstname')
        secondname=request.form.get('secondname')
        surname=request.form.get('surname')
        email=request.form.get('email')
        password=request.form.get('password')
        gender=request.form.get('gender')
        cursor.execute("insert into store.user values  (%s,%s,%s,%s,%s,%s)"%(firstname,secondname,surname,email,password,gender))
        cursor.commit()
        housenumber = request.form.get('housenumber')
        street = request.form.get('street')
        area= request.form.get('area')
        phonenumber1 = request.form.get('phone1')
        phonenumber2 = request.form.get('phone2')
        cursor.execute("insert into store.contact values (%s,%s,%s,%s,%s,%s)"%(phonenumber1,email,housenumber,street,area,phonenumber2))
        cursor.commit()
        return "weldone you are registerd"
    return render_template('signup.html')

if __name__ == '__main__':
    app.run()

Now here is the form ,the signup.html template

  <h1>We are pleased to have you join our community </h1>
      <p>There are only three essential things we need to know about you our dear customer so that you make the best of our services</p>
      <p>Currently we are operating in lefke Gemikonagi and Guzelyurt</p>
      <h2>Where you live </h2>
       <form action='/signup/' method="post">
           <fieldset>
                <legend>Identity: who you are</legend>
                <label>First name:
                     <input type="text" name="firstname" required>
                </label><br/> <br/>
                <label>Second name:
                     <input type="text" name="secondname" />
                </label><br/> <br/>
                <label>Surname:
                      <input type="text" name="surname" />
                </label>
           </fieldset><br/> <br/>
           <fieldset>
               <legend>Where you live :Adress</legend>
               <label>House number:
                    <input type="text" name="housenumber"  required >
               </label><br/> <br/>
               <label>Street:
                    <input type="text" name="street" placeholder="street or avenue" required >
               </label><br/> <br/>
               <label>Area:
                    <input type="text" name="area" placeholder="eg Lefke, Guz" required >
               </label><br/> <br/>
           </fieldset>
           <br/> <br/>
           <fieldset>
                <legend>Contact details</legend>
                <label>Phone number:
                     <input type="tel" name="phone1" pattern="[0-9]{4}-[0-9]{3}-[0-9]{4}" placeholder="Telsim or Turkcell" required>
                      <span class="note">Format: 1234-456-7890</span>
                </label><br/> <br/>
                <label>Email:
                     <input type="email" name="email" placeholder= "eg nim@gmail" required>
                </label><br/> <br/>
                <label>Phone number2:
                     <input type="tel" name="phone2" placeholder="optional"/>
                </label>

           </fieldset>
            <p>Select your gender<p>
                <label>
                    <input type="radio" name="gender" value="F"/>
                 Male
                </label>
                <label>
                    <input type="radio" name="gender" value="M" />
                    Female
                </label><br/> <br/>
                <input type="submit" vlaue="Sign up" class="lgbtn"/>

        </form>

The database is well connected and I havent noticed anything that coul be wrong with the tables Im using mysql but when I try to fill my own froms to put data into db i meet this weird error

pymysql.err.ProgrammingError: (1064, "You have an error in your SQL syntax;  check the manual that corresponds to your MySQL server version for the right syntax to use near '@gmail.com,None,F)' at line 1")

127.0.0.1 - - [01/Feb/2019 01:10:08] "POST /signup/ HTTP/1.1" 500 - any answer will be an eye opener and will be greatly appreciated I am a beginner

nit: you can remove `store.` to quantify tables. Your default database is `store` so you don't need to explicitly refer to those in the SQL. It will make it hard to later run a rest/production databases as separate. — danblack, Jan 31 '19 at 23:27

score 0 · Answer 1 · answered Jan 31 '19 at 23:25

0

Never concatenate user data into SQL strings. This will result in SQL injection.

Using MySQLCursor.execute() Method, use the params argument to include data.

answered Jan 31 '19 at 23:25

danblack

12,130
2
22
41

score 0 · Answer 2 · answered Jan 31 '19 at 23:30

I think the problem is that you are missing the quotes around the string objects in your insert statement:

cursor.execute("insert into store.user values ('%s', '%s', '%s', '%s','%s', '%s')" % (firstname, secondname, surname, email, password, gender))

In addition you should have a look at the flask-sqlalchemy library for management of your DB: flask-sqlalchemy. It's really easy to integrate with flask and will allow you to migrate your DB easily and write queries programatically.

Hope this helps!

FLASK mysqlsserver connection complex

2 Answers2