pset7 finance register where and how to write sql

Question

I'm working on register as part of the finance pset, and I think I have just about all of it, but I don't know where I need to write the SQL, my understanding is that when they click the register button, it should add the info into the SQL table and check to make sure it's unique. I'm not sure how to do this, any help would be appreciated, thanks

Answer 1

Essentially expanding my previous answer. Please give some feedback on how I can provide better help.

Note that this year's finance specification includes tests and therefore requires specific values for the name attributes in the HTML form.

I basically do register in a few steps:

1. Check that username and password are provided and password and confirmation match (if any of these are not as expected, apologise)

2. First SQL query: select statement on users searching for a record with that same username (similar to the query in login, but without the password)

   If that query returns a non-empty list, the name is already taken. If the result of the query instead is None, everything is fine.

3. If all went fine so far, now an insert statement, specifying the username and the hashed password for the corresponding fields. id and cash value are set up to be filled by the database.

Always do your SQL statements like db.execute("SELECT * FROM users WHERE name=:uname;", uname=username) instead of dangerous concatenation like db.execute("SELECT * FROM users WHERE name='"+username+"'"). Python functions when properly set up can take named parameters of form name=value, like in this case arbitrarily named parameter uname (here you can pick the name), and db.execute for example will insert those into the query in a safe way (like it will put quotes around a string value, and escape quotes that are within the string).