且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

管理URL的参数(Python Flask)

更新时间:2023-02-23 22:25:03

函数参数只映射到路由变量。这意味着在你的情况下, show_results 函数应该只有一个参数,而 labelname 。你甚至不需要把它默认为 None ,因为它总是被设置的(否则路由不匹配)。

为了得到查询参数,使用 flask.request.args

  from flask import request 

@ app.route('/ my_search /< labelname>')
def show_results(labelname = None):
results1 = request.args.get('results1', '0-100')
...

顺便提一句,你***不要构造你的SQL你的方式,使用占位符和变量。您的代码容易受到 SQL注入的影响。你不能相信任何来自用户的输入。



正确的方法取决于实际的数据库,但是例如,如果你使用MySQL,这样做(不是我没有使用操作符):

  sql =.... LIMIT%s,%s
g.db.execute(sql,(limit_offset,limit_count))


I want some search feature in my website. In the output page, I am getting all the results in single page. However, I want to distribute it to many pages (i.e. 100 searches/page). For that, I am passing a number of default searches in "urlfor" but it isn't working. I know I am making a small error but I am not catching it.

Here is my code below:

@app.route('/', methods=['GET', 'POST'])
def doSearch():
    entries=None
    error=None
    if request.method=='POST':
        if request.form['labelname']:
            return redirect(url_for('show_results',results1='0-100', labelname=request.form['labelname'] ))
        else:
            error='Please enter any label to do search'
    return render_template('index.html',entries=entries, error=error)




@app.route('/my_search/<labelname>')
def show_results(labelname=None, resultcount=None, results1=None):
    if not session.get('user_id'):
        flash('You need to log-in to do any search!')
        return redirect(url_for('login'))

    else:
        time1=time()
        if resultcount is None:
            total_count=g.db.execute(query_builder_count(tablename='my_data',nametomatch=labelname, isextension=True)).fetchall()[0][0]

        limit_factor=" limit %s ,%s"%(results1.split('-')[0],results1.split('-')[1])

        nk1=g.db.execute(query_builder(tablename='my_data',nametomatch=labelname, isextension=True) + limit_factor)
        time2=time()
        entries=[]
        maxx_count=None
        for rows in nk1:
            if maxx_count is None:
                maxx_count=int(rows[0])
            entries.append({"xmlname":rows[1],'xmlid':rows[2],"labeltext":rows[12]})
        return render_template('output.html', labelname=labelname,entries=entries, resultcount=total_count, time1=time2-time1, current_output=len(entries))

Here I want output on the URL like "http://127.0.0.1:5000/my_search/assets?results1=0-100" Also, if I edit the url address in browser like I want the next 100 result I can get it on "http://127.0.0.1:5000/my_search/assets?results1=100-100"

Note: here I am using sqlite as backend; so I will use "limit_factor" in my queries to limit my results. And "query_builder" and "query_builder_count" are just simple functions that are generating complex sql queries.

but the error I am getting is "NoneType" can't have split. It stopped at "limit_factor".

Here limit factor is just one filter that I have applied; but I want to apply more filters, for example i want to search by its location "http://127.0.0.1:5000/my_search/assets?results1=0-100&location=asia"

Function parameters are mapped only to the route variables. That means in your case, the show_results function should have only one parameter and that's labelname. You don't even have to default it to None, because it always has to be set (otherwise the route won't match).

In order to get the query parameters, use flask.request.args:

from flask import request

@app.route('/my_search/<labelname>')
def show_results(labelname=None):
    results1 = request.args.get('results1', '0-100')
    ...

Btw, you better not construct your SQL the way you do, use placeholders and variables. Your code is vulnerable to SQL injection. You can't trust any input that comes from the user.

The correct way to do this depends on the actual database, but for example if you use MySQL, you would do this (not that I'm not using the % operator):

sql = ".... LIMIT %s, %s"
g.db.execute(sql, (limit_offset, limit_count))