From eb0bdf504949966dbdf2150a1709674ff3d899f8 Mon Sep 17 00:00:00 2001
From: ada-dmitry <ada.dmitry@gmail.com>
Date: Sun, 5 May 2024 23:30:58 +0300
Subject: [PATCH] 0.5.1

---
 0.5_test/__pycache__/dbtable.cpython-311.pyc  | Bin 8268 -> 8302 bytes
 0.5_test/dbtable.py                           |  18 +++++++++++++-----
 0.5_test/main.py                              |   2 ++
 .../__pycache__/cath_table.cpython-311.pyc    | Bin 2318 -> 2122 bytes
 0.5_test/tables/cath_table.py                 |  17 ++++++++++-------
 5 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/0.5_test/__pycache__/dbtable.cpython-311.pyc b/0.5_test/__pycache__/dbtable.cpython-311.pyc
index 391592524a65ab1ba971e4e39a0ec027cf470199..57cc3439f441aeb4b8a903e43ad5723b644b2420 100644
GIT binary patch
delta 675
zcmX@(@XmpEIWI340}${(Gfz9ek@qbx<Dt#JdD$5!C-6&7mghI-s{%@<uz|>0<`VwN
z5BTLpIY1gfAd3@1GcYXRn%pR*#8k@y)ThBw%gV`6!?J*Tav`UvE^`fQ8sjo128Pu@
z3;~P`H4ItUOyL2U;=;&~XQ9kcA_Y?pw1^MJ&f<r$R2YgBaT+85GHCJ~0bxe=$r}We
z_<1xH!W?}<U4u1Li#0U`CqEWYW52~(P?VWhGTD$<a<Y=3o+eunC?syNlqKdA-(t+X
z#adXJT2xtN4-#Yp3YMl87qbC53X}5$^%*@T&l61Z{J_B=D8E2tx%?vei;6~96pbzl
z7;Ol?C}6R}WWVJu%L5_TT@x?4CSG(+zT%pE(K_Xdb;?D7lnd#l7X?Z?SnqQ1cBFRl
z^zd}>Og=9wt|=%wU2>A-43mlSQ{+3?KCrNGYTV%A@AvNVp250+ZARrq9?dH}niqI9
zCwB=Y2^gBXs52Z<H*%F>J}S-VDzo{I&?ZJkx6SKCE;F))0UcTtKDk4zoiT8-fVdW8
z#AIu6O-8@Xsp6*@8AB%<N`^tyL~rhuoWsPJG+9eVi7{-luZ%xq<m9<Bs;ospKqDrf
zl1XHY+pHrS%P1NQGBOH8#DR!J5Ro%^p4<U`VOIVR3~)kga;|(GW8vgC@{0C3jEs^W
S7_gHc!Qx+V$QJPe%?AKeBdB=*

delta 679
zcmaFoaK?dmIWI340}zB|nWyn?<bBJ_xMA~eUUo*dTIL$&6xPWPgvBOH@tX*wuvGz7
zRq-+~AW7`w5l~5CN0MO3Vh0%p0$Cgont@>f=j1|8k;xyJ_}FS$I2meKCO1fnO-|z%
z6~(5Q8?1PNfPhn;g)&2l1k4nmi9pLCAd3&iQeh}kWMrtpZZAL7C`Cq&$%h1#1UWSo
z!W?}<U4u1>%z*}I3QYbipf=f%S8}qYpq?CS5hx&Tv6Lm|6yIXZEV2diitK?zF)NUm
zJV8*O(RK0x!L;xjd@?gi=GV`vzbJ2TMc&{dpTP#>i+pAs%r`i=J4*U1yDDdhT$ePx
zBx!n4()@~~`9*$<EBqEatS|DrUF2{>QPx@CQ@=p?BEQN-4wcCd#U;c)u&{7y+~DEw
z_wMqZ!F-WN<_eF@1s<8n>xGg8w2WQk7>>vpxe7BM6=HN1-mECRiIL42=(x`nll#SW
zHnWN@Vq^;jIXh(XTCsLUzsaWJT8yES6T~$cy*GD>pJrqY0?KMmt`*Uq+$yOKQ5&&&
zljIyG#`wwpGD?iWlZ#~h8N((Yl2PTj#Rd$D($wO~Z)6e~qc{7>#xjZqfJ_eu5z!zb
y4n$;4J|K61Ux1bW0|T5;ncOd5$Cy8vPeIW>laW#K0|R#QBUt<k4%s45i~|5UZKtsS

diff --git a/0.5_test/dbtable.py b/0.5_test/dbtable.py
index 7888a05..de7b92c 100644
--- a/0.5_test/dbtable.py
+++ b/0.5_test/dbtable.py
@@ -2,6 +2,11 @@
 
 from dbconnection import *
 
+'''
+FIXME:
+1) Не работает санация для insert_one!
+'''
+
 class DbTable:
     dbconn = None
 
@@ -47,18 +52,21 @@ class DbTable:
         return
 
     def insert_one(self, vals):
-        for i in range(0, len(vals)):
+        for i in range(len(vals)):
             if type(vals[i]) == str:
                 vals[i] = "'" + vals[i] + "'"
             else:
                 vals[i] = str(vals[i])
-        sql = "INSERT INTO " + self.table_name() + "("
-        sql += ", ".join(self.column_names_without_id()) + ") VALUES("
-        sql += ", ".join(vals) + ")"
+        # sql = "INSERT INTO " + self.table_name() + "("
+        # sql += ", ".join(self.column_names_without_id()) + ") VALUES("
+        # sql += ", ".join(vals) + ")"
+        query = "INSERT INTO " + self.table_name() + "(" + ", ".join(self.column_names_without_id()) + ") VALUES(%s)"
+        print(query)
         cur = self.dbconn.conn.cursor()
+        values = ", ".join(vals)
         # cur.execute(sql)
         try:
-            cur.execute(sql)
+            cur.execute(query, (values,))
             self.dbconn.conn.commit()
         except psycopg2.errors.UniqueViolation:
             self.dbconn.conn.rollback()
diff --git a/0.5_test/main.py b/0.5_test/main.py
index 1cf01d2..89d60d5 100644
--- a/0.5_test/main.py
+++ b/0.5_test/main.py
@@ -15,11 +15,13 @@ TODO:
 3) Устранить SQLi с помощью санации атрибутов - Не выполнено
 
 FIXME:
+1) Не работает санация для insert_one!
 '''
 
 
 class Main:
     
+    
     config = ProjectConfig()
     connection = DbConnection(config)
 
diff --git a/0.5_test/tables/__pycache__/cath_table.cpython-311.pyc b/0.5_test/tables/__pycache__/cath_table.cpython-311.pyc
index 6b9525707c1c358ddfa3a51e2cc5afd66ea02266..514e2fce7e00fb54845e0a0a547132a7255c2f05 100644
GIT binary patch
delta 678
zcmaiw&ubGw6vt<Ge(a>1#M){?Z31gaW%pD(6_pl6R}_CiS`aUmWwW8tX4mcysj{IS
zg9mLoh4#3odZ-sKf>)0{XbU}*@t=s)i+FK1i9J}s2k*;!Z@%+p_`Dg}9nQbY<%WQW
z_ur=LpYVtLFL@M+7K%LLLN-B7YRR3i1-6bSF|5f6WEaUOdkRmJ7K&kl(zXC%IYxD9
zTLxf9WIv?Nm!h2Dp1+I=tMLBI3pdQW=DexhtUkD>*;cryJ-lUB&0e|ST1`ir(I$f{
z92mr>VhcyM=enHOkso+IM^C(l%N1wEv7^utW3Sn4ga-E2)C-?mOFZ+;@~!4Vu)M^f
zxW%y;MoxeMkb%Z_ke;)I_Z8?;aCWAhVY5oHGCZ=WtSeivlikR+@gY^;s;||x+X>!U
z*{Ave)%U2*X7SX}F`Cbv-El!gCoLEckc@*E#?lD}f=r(gE2C4ZEfl6-9Yl<_B>_xi
zKWg&WpAyUgL+~=@1h4D!TBG(qWPXZ$K+R9r_~%k73E{Nvg!ZE6I_!{)Wz{~R<;d}0
zu%F~INsU33T~bP=!nL;AB_NaS5xA37lHxu!4ydt54Yr{?A`|ISgB>Z4D-=(3!LgiC
jaJdWq78cQ~(iHnh&rg>maeh+Pl<(>E$3Kqzym;(4E`g~?

delta 876
zcmZva&rcIU6vt<GW@jfBTBLwQ*RU-}Qxl=lm>Pj7)`|yzBtW7hMnbwJmOvY~#YnTJ
z9y~N2kYo-b(XjC#CSKsi(WCLyNqT5{^e?E9lU{tYR1$=jnQ!L3H#2YYdGozvwbQ@V
z-hKjsecevX?~xt<AGKQp7sLEzC<whpmf|26@ozX1Dnayx>Zq1lYHzKuMO=kH!UKac
zX=zehNwlDX<Jp3|&ojQJol9Z|yRym=bJR~z^9#&<Q;>7)EiQ%k#LDzusqJR!PHH-3
z-kQ9B*DQ6I4{oO>Q)YUu_+&OWx0ETVW6=gGsnL;`Zo`{VgDm8;Ih%RQbUv4B(Dbrh
z$lDD)^E{JYE@mK*Us}o*W5o8!UHIADVgnbRg2<f&VkVf~hWH8zCtrd864m|2dU3P7
zQ5JpiT3=lF;}u+IzG@&WSlC-uR@N_WCN>i8rFWz6M@1m|c|Zh)1RJVg{(+u4$$W2o
zuYGGt!9q0_s<IIOL56*jo7W4Xa6`L6pcPoQBI30II9jTsc;vCC<bXfst6HeX!AF3q
zuEwuu{bf>=JX+?E!}~0)_g@N4p%{P;OabWRw3)S9th@eaZH}4I-wKQoTQ(kmOUm|X
zDQBd}dbR=5VDlM%f%Y*Su+A1Ti~J$IN<)w-Ec110T<h$2t*!jWyckT>1{0z)QPJxx
zPz?@kcZuNTT`YnlyJ-;|7i?T+_R&oUX4IHbWd^U(85)+=&hugY@c`8#O>`g~R68r(
v!@_s;>oajUBR^kZ0;Gu*MQKu`^i)yz{%De31&$q+HT|cI?j4h|{czV`x7Erf

diff --git a/0.5_test/tables/cath_table.py b/0.5_test/tables/cath_table.py
index afa037c..40bdb34 100644
--- a/0.5_test/tables/cath_table.py
+++ b/0.5_test/tables/cath_table.py
@@ -14,18 +14,21 @@ class CathTable(DbTable):
         return ['CONSTRAINT "Name" UNIQUE (cath_name)']
     
     def delete(self, val):
-        sql = "DELETE FROM " + self.table_name()
-        sql += " WHERE cath_name"
-        sql += "=" + "'" + "".join(val) + "';"
+        # sql = "DELETE FROM " + self.table_name()
+        # sql += " WHERE cath_name"
+        # sql += "=" + "'" + "".join(val) + "';"
+        param_sql = "DELETE FROM cath WHERE cath_name = %s;"
         cur = self.dbconn.conn.cursor()
-        cur.execute(sql)
+        value = "".join(val)
+        cur.execute(param_sql, (value,))
         self.dbconn.conn.commit()
     
     def find_by_name(self, name):
         cur = self.dbconn.conn.cursor()
-        sql_sel = "SELECT id FROM " + self.table_name()
-        sql_sel += " WHERE cath_name = " + "'" + name + "'" + ";"
-        cur.execute(sql_sel)            
+        param_query = "SELECT id FROM cath WHERE cath_name = %s;"
+        # sql_sel = "SELECT id FROM " + self.table_name()
+        # sql_sel += " WHERE cath_name = " + "'" + name + "'" + ";"
+        cur.execute(param_query, (name,))           
         ret = cur.fetchone()
         return  list(ret)[0] 
         # sql = "SELECT * FROM " + self.table_name()