0

I have two .cgi scripts as of right now. I am trying to have a user input a keyword on one website (the first cgi script) and then it will send that data to the next cgi script. It currently sends it to the next page fine but I also want to save the information the user types in to a MySQL table named "keywords". I am having trouble figuring out how exactly to do that. Here is my first cgi script that prompts the user for a keyword:

#!/usr/bin/env python
import cgi
import cgitb
cgitb.enable()

form = cgi.FieldStorage()
keyword = form.getvalue('keyword')

print 'Content-type: text/html\r\n\r'
print '<html>'
print '<h1>Please enter a keyword of your choice</h1>'
print '<form action="results.cgi" method="post">'
print 'Keyword: <input type="text" name="keyword">  <br />'
print '<input type="submit" value="Submit" />'
print '</form>'
print '</html>'

Here is my second .cgi file. In this I am trying to print the keyword that was typed in from the previous page (that works fine) and also send it and save it my mysql table (thats where the problem is):

cgitb.enable()

form = cgi.FieldStorage()

keyword = form.getvalue('keyword')

print 'Content-type: text/html\r\n\r'
print '<html>'
print keyword
print '</html>'

db = MySQLdb.connect(host="", user="",   passwd="", db="")
cursor = db.cursor()
sql = """INSERT INTO keywords(keywords) VALUES (keywords)"""
cursor.execute(sql)
cursor.fetchall()
db.close()

Basically I am new to MySQL in general and I'm pretty sure it comes down to my mysql code being all messed up and doing what I want it to do. It doesn't fetch any errors, just doesn't add anything to the table.

4

1 に答える 1

1

cursor.executeメソッドにパラメーターを渡していません。

あなたは必要になるでしょう：

sql = "INSERT INTO keywords (keywords) VALUES (%s)"
cursor.execute(sql, keyword)

keywordsテーブルが呼び出され、 という列が含まれていると仮定すると、これは機能するはずkeywordsです。

詳細については、MySQLdbユーザーガイドをご覧ください。

このシンプルなアプリは、Web アプリが脆弱になる可能性があるほとんどのセキュリティ脆弱性 (SQL インジェクションを除く) にさらされていることに注意してください。これには、特にXSS 攻撃が含まれます。

于 2012-12-12T03:20:07.063 に答える