0.5.1

0.5_test/dbtable.py

@@ -2,6 +2,11 @@
 
 from dbconnection import *
 
+'''
+FIXME:
+1) Не работает санация для insert_one!
+'''
+
 class DbTable:
     dbconn = None
 
@@ -47,18 +52,21 @@ class DbTable:
         return
 
     def insert_one(self, vals):
-        for i in range(0, len(vals)):
+        for i in range(len(vals)):
             if type(vals[i]) == str:
                 vals[i] = "'" + vals[i] + "'"
             else:
                 vals[i] = str(vals[i])
-        sql = "INSERT INTO " + self.table_name() + "("
-        sql += ", ".join(self.column_names_without_id()) + ") VALUES("
-        sql += ", ".join(vals) + ")"
+        # sql = "INSERT INTO " + self.table_name() + "("
+        # sql += ", ".join(self.column_names_without_id()) + ") VALUES("
+        # sql += ", ".join(vals) + ")"
+        query = "INSERT INTO " + self.table_name() + "(" + ", ".join(self.column_names_without_id()) + ") VALUES(%s)"
+        print(query)
         cur = self.dbconn.conn.cursor()
+        values = ", ".join(vals)
         # cur.execute(sql)
         try:
-            cur.execute(sql)
+            cur.execute(query, (values,))
             self.dbconn.conn.commit()
         except psycopg2.errors.UniqueViolation:
             self.dbconn.conn.rollback()

0.5_test/main.py

@@ -15,11 +15,13 @@ TODO:
 3) Устранить SQLi с помощью санации атрибутов - Не выполнено
 
 FIXME:
+1) Не работает санация для insert_one!
 '''
 
 
 class Main:
     
+    
     config = ProjectConfig()
     connection = DbConnection(config)
 

0.5_test/tables/cath_table.py

@@ -14,18 +14,21 @@ class CathTable(DbTable):
         return ['CONSTRAINT "Name" UNIQUE (cath_name)']
     
     def delete(self, val):
-        sql = "DELETE FROM " + self.table_name()
-        sql += " WHERE cath_name"
-        sql += "=" + "'" + "".join(val) + "';"
+        # sql = "DELETE FROM " + self.table_name()
+        # sql += " WHERE cath_name"
+        # sql += "=" + "'" + "".join(val) + "';"
+        param_sql = "DELETE FROM cath WHERE cath_name = %s;"
         cur = self.dbconn.conn.cursor()
-        cur.execute(sql)
+        value = "".join(val)
+        cur.execute(param_sql, (value,))
         self.dbconn.conn.commit()
     
     def find_by_name(self, name):
         cur = self.dbconn.conn.cursor()
-        sql_sel = "SELECT id FROM " + self.table_name()
-        sql_sel += " WHERE cath_name = " + "'" + name + "'" + ";"
-        cur.execute(sql_sel)            
+        param_query = "SELECT id FROM cath WHERE cath_name = %s;"
+        # sql_sel = "SELECT id FROM " + self.table_name()
+        # sql_sel += " WHERE cath_name = " + "'" + name + "'" + ";"
+        cur.execute(param_query, (name,))           
         ret = cur.fetchone()
         return  list(ret)[0] 
         # sql = "SELECT * FROM " + self.table_name()