Have a look at this: http://www.zope.org/Members/spinwing/ZSQL_Results Jonathan ----- Original Message ----- From: Muk Yan To: zope@zope.org Sent: Tuesday, August 01, 2006 2:50 PM Subject: [Zope] MySQL queries in Python Dear Coveted Braintrust, I was wondering if anyone had any experience with MySQL queries in Python in Zope: import MySQLdb import string request = container.REQUEST session = request.SESSION result = (context.aq_parent).selects.select_from_table() print result return printed WHERE select.select_from_table() IS: SELECT name FROM person WHERE ID = <dtml-var "REQUEST.SESSION.get ('person_id')"> I know the MySQL query works, but I get garbage results from the python script (<Shared.DC.ZRDB.Results.Results instance at 0x132a5c88>). All I want is to contain the results of the SQL query in a list or container. Thanks and take care, Muk Yan ------------------------------------------------------------------------------ _______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )

import MySQLdb

This is probably redundant.

import string

request = container.REQUEST session = request.SESSION

result = (context.aq_parent).selects.select_from_table()

print result

Assuming you want the person's name printed, change this line to: print result[0].name Think of the result from a ZSQL query as a list/iterator over the resulting rows. In your case I'm assuming there is only one person row w/ the given id, so there is only one row in the result, but you still have to explicitly de-reference it w/ its index. HTH, John

On Tue, Aug 01, 2006 at 02:50:19PM -0400, Muk Yan wrote:

Dear Coveted Braintrust,

I was wondering if anyone had any experience with MySQL queries in Python in Zope:

People have already answered your main question, but:

SELECT name FROM person WHERE ID = <dtml-var "REQUEST.SESSION.get('person_id')">

Never ever pass raw user input to a sql query! If you're not familiar with the phrase "sql injection"... google it :) The zope book relational databases chapter explains how to use <dtml-sqlvar> which is one way to avoid the danger. -- Paul Winkler http://www.slinkp.com