2016-09-30 29 views
0

我想在<td>在下面的index.html页面显示从数据库中的每一行:显示新的页面上的数据在Python

$def with(items) 
<h1></h1> 
<br/> 
<br> 
<table border="1"> 
    <tr> 
     <th>Name</th> 
     <th>address</th> 
     <th>number</th> 
    </tr> 

    <tr> 
     <td>//want name here</td> 
     <td>//address here</td> 
     <td>//number here</td> 
    </tr> 
</table> 

app.py代码:

import web 
import MySQLdb 

urls = (
    '/', 'Index' 
) 

app = web.application(urls, globals()) 

render = web.template.render('templates/') 

class Index(object): 
    def GET(self): 
     return render.hello_form() 

    def POST(self): 
      form = web.input(name="a", newname="s", number="d") 
      conn = MySQLdb.connect(host= "localhost", user="root", passwd="", db="testdb") 
      x = conn.cursor() 
      x.execute("SELECT * FROM details WHERE name = '%s'" % (form.name)) 
      conn.commit() 
      items = x.fetchall() 
      for row in items: 
       conn.rollback() 
       conn.close() 
       return render.index(items) 
    if __name__ == "__main__": 
     app.run() 
+0

是,一个SQL注入我看到这里? – Aif

+0

我没有得到你..?@ aif – Edison

+0

如果名字=''union select'concat(login,':',password)from user where'admin'会发生什么? (是的,这是伪代码)请参阅https://www.owasp.org/index.php/SQL_Injection – Aif

回答

1

项目(获取的结果)将是一个元组数组。按照原样返回数组,因为您希望在HTML上显示整个数据,并且HTML只会呈现一次。

app.py代码

import web 
import MySQLdb 

urls = (
    '/', 'Index' 
) 

app = web.application(urls, globals()) 

render = web.template.render('templates/') 

class Index(object): 
    def GET(self): 
     return render.hello_form() 

def POST(self): 
     form = web.input(name="a", newname="s", number="d") 
     conn = MySQLdb.connect(host= "localhost", user="root", passwd="", db="testdb") 
     x = conn.cursor() 
     x.execute("SELECT * FROM details WHERE name = '%s'" % (form.name)) 
     items = x.fetchall()  
     conn.close() 
     return render.index(items) // return the array of results as a whole 
if __name__ == "__main__": 
    app.run() 

在index.html的

$def with(items) 
<h1></h1> 
<br/> 
<br> 
<table border="1"> 
    <tr> 
     <th>Name</th> 
     <th>address</th> 
     <th>number</th> 
    </tr> 
    $for row in items: 
     <tr> 
     <td>$row[0]</td> 
     <td>$row[1]</td> 
     <td>$row[2]</td> 
     </tr> 
</table> 

Iterate over the items and display them 
+0

其不显示任何东西,只是显示空白页 – Edison

+0

尝试检查数据是否被提取。尝试打印在app.py中获取的项目并渲染一个不同的模板,它将打印所有项目。要渲染新的模板,请执行:$ def with(items) $ items' –

+0

我认为数据没有被提取,所以我应该怎么做全新的python – Edison

相关问题