Tukukkk

I have a flask webpage that asks for the user to select few fields and returns back output based on the fields selected.

The below code works just fine with 3 fields. If the user selects all the 3 fields there are no issues. However if any of the fields are not selected, it returns an error saying column "none" does not exist.

def template():

    form = TestForm()

    if form.validate_on_submit():

        student_id = form.student_id.data

        class_id = form.class_id.data

        roll_id = form.roll_id.data

        print(student_id)

        print(class_id)

        print(roll_id)

Could anyone assist on how I could modify this such that only fields selected are passed and the unselected fields are ignored. Thanks

Edit (HTML code):

<form action=""

          enctype="multipart/form-data"

          method="POST">

        {{form.hidden_tag()}}

        <table>



            <div class="checkbox">

            <label>

                <input type="checkbox" name="student_id" value="student_id"> student_id

            </label>

            </div>

            <div class="checkbox">

            <label>

                <input type="checkbox" name="class_id" value="class_id"> class_id

            </label>

            </div>

            <div class="checkbox">

            <label>

                <input type="checkbox" name="roll_id" value="roll_id"> roll_id

            </label>

            </div>

            <tr class="submit">

                <td></td>

                <td><button type="submit">Get the Report!</button>

                </td>

            </tr>

        </table>

    </form>

Query that runs after getting user input:

def function(*field_names):

    cursor = conn.cursor()

    cursor.execute('select {} from enrolments'.format(', '.join(str(field) for field in field_names)))

    print(field_names)

    output_file = dwh_cursor.fetchall()

HTML checkboxes only submit if checked. It looks like you're using flask-wtforms and that is what is giving you the None values for checkboxes that aren't checked to work around this feature. You could just make sure you're getting actual field names like this:

for field in field_names:

    if field:

        cursor.execute('select {} from enrolments'.format(', '.join(str(field)))

Which would prevent None from going into the query, but this is a terrible and sloppy idea. Even with the CRSF token, you open yourself up to an attacker spoofing your form and executing arbitrary SQL.

You should consider using an ORM like flask-sqlalchemy or else, at least restrict what a valid field_name looks like:

for field in field_names:

    if field in ['student_id', 'class_id', 'roll_id']:

        cursor.execute('select {} from enrolments'.format(', '.join(str(field)))