Python/Flask - 将用户输入与数据库值进行比较

Question

Im trying some learning-by-doing here with Python and Flask and have run into something I don't quite understand - hoping someone out there might be able to help or explain this behavior.

I'm not building anything real, just trying to learn and understand what is going on here.

I'm playing with registration / login form in Python/Flask and am struggling with the login part.

I have built a registration from which writes name, email and password (unhashed, that comes later) to a simple table 'users' with a | ID | name | email | password | structure, all values being varchar except ID which is INT and auto increments.

My imports are

import os
from flask import Flask, session, request
from flask_session import Session
from sqlalchemy import create_engine
from sqlalchemy.orm import scoped_session, sessionmaker
from flask import Flask, render_template
app = Flask(__name__)

# Set up database
engine = create_engine(os.getenv("DATABASE_URL"))
db = scoped_session(sessionmaker(bind=engine))

I have a html login form that looks as follows

<form action="{{ url_for('login') }}" method="post">
    <div class="form-group">
      <label for="email">E-mail:</label>
      <input type="email" name="email" class="form-control" placeholder="Enter email">
    </div>
    <div class="form-group">
      <label for="pwd">Password:</label>
      <input type="password" name="pwd" class="form-control" placeholder="Enter password">
    </div>
    <button type="submit" class="btn btn-primary">Login</button>
</form>
<p> {{ logintry }}

My Flask application route for 'login' is as follows

@app.route("/login", methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        uname = request.form.get("email")
        passwd = request.form.get("pwd")
        pwCheck = db.execute("SELECT password FROM users WHERE email = :uname", {"uname": uname}).fetchone()

        if pwCheck == passwd:
            return render_template("authenticated.html")
        else:
            return render_template("login.html", logintry="Login Failure")
    else:
        return render_template("login.html")

In this sample I am trying to log in with test@test.com email and password is 1234

The problem I have is that the database value seems to be returned as

('1234',)

Whereas the user input is simply presented as

1234

And therefore they are not equal, and the login fails.

Can anyone help guide me here, or maybe explain what is going on?

Thanks in advance.

Answer 1

There are two main things to understand here: 1. What the database is returning 2. What your form is returning

In order to understand how to get the login to work you must understand how to ensure that the input/results your form and database give you, can be compared.

In your question you said that the database is returning ('1234',). This is a tuple in python, and can be indexed. Indexing your tuple, like so

pwCheck[0]

would return '1234'.

So instead of comparing the raw result that your database query is returning, you should instead understand that your database is returning data that needs a little bit more processing before comparing against the form input.

You could add an extra line which creates a new variable db_pwd, like so

db_pwd = pwCheck[0]

And then check if db_pwd == passwd