Python - 如何验证 tkinter 输入字段

Question

在我的程序中，我有一个 sqlite 数据库，其中数据通过 tkinter gui 中的条目小部件附加到其中。我想要它，因此数据仅在验证后才附加到数据库中，因为目前没有验证。

例如，在下面的函数中，它将客户 ID、名字、姓氏、地址和电话号码附加到数据库中的客户表中。我想要它，所以 customerID 条目只接受整数，名字、姓氏和地址不为空，而 phoneNumberEntry 也只接受整数。

我看到人们使用 validatecommand，但我认为我无法实现它，因为我已经在使用命令将数据附加到数据库中。

def appendToCustomerTableEntry(event):
    top = Toplevel()
    top.title("Add to customer table")

    Label(top, text = "customerID: ").grid(sticky = E)

    customerIDEntry = Entry(top)
    customerIDEntry.grid(row = 0, column = 1)

    Label(top, text = "Forename: ").grid(row = 1, sticky = E)

    customerForenameEntry = Entry(top)
    customerForenameEntry.grid(row = 1, column = 1)

    Label(top, text = "Surname: ").grid(row = 2, sticky = E)

    customerSurnameEntry = Entry(top)
    customerSurnameEntry.grid(row = 2, column = 1)

    Label(top, text = "Address: ").grid(row = 3, sticky = E)

    customerAddressEntry = Entry(top)
    customerAddressEntry.grid(row = 3, column = 1)

    Label(top, text = "Phone Number: ").grid(row = 4, sticky = E)

    customerPhoneNumberEntry = Entry(top)
    customerPhoneNumberEntry.grid(row = 4, column = 1)

    exitButton = Button(top, text = "Exit", command = top.destroy)
    exitButton.grid(row = 5, column = 2, sticky = W)

    appendButton = Button(top, text = "Append", command =   lambda:appendToCustomerTable
                  (customerIDEntry.get(), customerForenameEntry.get(), customerSurnameEntry.get(),
                   customerAddressEntry.get(), customerPhoneNumberEntry.get()))
    appendButton.grid(row = 5, column = 1, sticky = E)


def appendToCustomerTable(customerID, Forename, Surname, Address, TelephoneNumber):
    c.execute("INSERT INTO customerTable VALUES (?, ?, ?, ?, ?);", (customerID, Forename, Surname, Address, TelephoneNumber ))
    conn.commit()

Answer 1

这是 sql 卫生问题，还是 python 编程问题？

如果 sql sanitation，您需要弄清楚要拒绝哪些 sql 字符串或字符，可能还有一些库可以做到这一点。 https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

以编程方式运行 if 语句，更改操作顺序并使用字符串替换。 http://bobby-tables.com/python.html

在您的代码中，您需要注意的是有人试图通过您的字段发布代码。看看链接，特别是最后一个。

Answer 2

首先尝试“dont repeat your self”

# you can declare here the input type of your argument default and the type of them 
def build(ui_title = [], int_arg = 0):
    # on top you can also assert the input
    # continue only if ui_title is True else give a AssertionError 
    assert (ui_title), "list is empty!!!"

    # lets check int_arg for int
    assert (int_arg==int), "{0} except int get {1}".format(int_arg ,type(int_arg))

    for row,text in enumerate(ui_title):
        Label(top, text = str(text)).grid(sticky = E)
        customerIDEntry = Entry(top)
        customerIDEntry.grid(row = int(row), column = 1)
        if text=="Exit":
            exitButton = Button(top, text = str(text), command = top.destroy)
            exitButton.grid(row = int(row), column = 2, sticky = W)

ui_title = ["customerID", "Forename: ", "Surname: ", "Address: ", "Phone Number: ", "Exit"]
build(ui_title) # will work
build(ui_title, int_arg = "Hallo") # will not work, because int_arg get string and the build method will raise a AssertionError