I'm working on register as part of the finance pset, and I think I have just about all of it, but I don't know where I need to write the SQL, my understanding is that when they click the register button, it should add the info into the SQL table and check to make sure it's unique. I'm not sure how to do this, any help would be appreciated, thanks
Essentially expanding my previous answer. Please give some feedback on how I can provide better help.
Note that this year's finance specification includes tests and therefore requires specific values for the
name attributes in the HTML form.
I basically do register in a few steps:
- Check that
passwordare provided and
confirmationmatch (if any of these are not as expected, apologise)
First SQL query: select statement on users searching for a record with that same username (similar to the query in
login, but without the password)
If that query returns a non-empty list, the name is already taken. If the result of the query instead is
None, everything is fine.
- If all went fine so far, now an insert statement, specifying the username and the hashed password for the corresponding fields. id and cash value are set up to be filled by the database.
Always do your SQL statements like
db.execute("SELECT * FROM users WHERE name=:uname;", uname=username) instead of dangerous concatenation like
db.execute("SELECT * FROM users WHERE name='"+username+"'"). Python functions when properly set up can take named parameters of form
name=value, like in this case arbitrarily named parameter
uname (here you can pick the name), and
db.execute for example will insert those into the query in a safe way (like it will put quotes around a string value, and escape quotes that are within the string).