usage of dtml-sqltest tag in Zsql method
Hi Someone please help me out with this: I am passing a string in this format (215,216) from the python script to the Zsql method. The SQl query should have the following form: select * from employees where id in (215,216) but is as follows: select * from employees where id in '(215,216)' which does not give the required result.The id is of data type string/nb. It doesnt accept integer values. A sample usage is given in the Zope documentation **************************************** select * from employees <dtml-sqlgroup where> <dtml-sqltest salary op="gt" type="float" optional> <dtml-and> <dtml-sqltest first type="nb" multiple optional> <dtml-and> <dtml-sqltest last type="nb" multiple optional> </dtml-sqlgroup> If first=Bob and last=Smith, McDonald it renders: select * from employees where (first='Bob' and last in ('Smith', 'McDonald') ) *****************************************8 But it is not working when I tried it. I get the following result select * from employees where (first='Bob' and last = 'Smith,McDonald' ) Please help me out!!Is there any other type for declaring the database fields other than int,float,string and nb.I am using Zope version 2.5.1 . The documentation covers Zope 2.5. Thanks Anitha _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail
Anitha George wrote at 2003-7-23 07:08 +0000:
Someone please help me out with this:
I am passing a string in this format (215,216) from the python script to the Zsql method. The SQl query should have the following form: select * from employees where id in (215,216) but is as follows: select * from employees where id in '(215,216)' which does not give the required result.The id is of data type string/nb. It doesnt accept integer values.
"dtml-sqltest multiple" works as you expect only when the value is a sequence (list or tuple or something like this). For a string, it (correctly) behaves as you observe. You can use: ... id in <dtml-var YourParameter sql_quote> ... Be warned that the use of "dtml-var" poses a potential security risk. Most databases provide some way to enter several canned SQL commands, e.g. separated by ";". When you have such a DB and someone can control "YourParameter", he may pass (e.g.) "(123); delete from TABLE" and the rows in "TABLE" were gone. The "sql_quote" above should prevent this, but I am not sure that is will escape the ";" in the example. Dieter
participants (2)
-
Anitha George -
Dieter Maurer