0

Below is my code and when executed it is showing above mentioned error:

import os
import cx_Oracle
import traceback
import sys
from tabulate import tabulate

cx_Oracle.init_oracle_client("C:/oracle/instantclient_21_3")

connection = cx_Oracle.connect(
 user="sxk7128",
 password="1234567890Qwertyuiop",
 dsn="acaddbprod-2.uta.edu:1523/pcse1p.data.uta.edu")

 cursor = connection.cursor()
 print("Successfully connected to Oracle Database")


ch=-1
while(ch != 0):
 try:
    print("\n\n-------------------------------------- MENU --------------------------------")
    print("1.  View all relations names                        2.  contents of each relation               
  3.  insert new customer data ")
    print("4.  View customer Data with ID                      5.  Delete customer phone 
   number              6.  Update Destination City  ")
    print("7.  Rollup operation with destination city,cost     8.  Cube operation with city & 
  sum of ticket cost ")
    print("9.  View Average buyer rating of transactions       10. Buy orders and Cities with 
   avg ticket cost above 10      11. Sort most used destination cities        0. EXIT   ")

     ch=int(input("\nEnter your choice: "))

     if ch==1:
        a=cursor.execute("select table_name from user_tables")
        print(tabulate(a))
    
     if ch==2:
        relationname=input("enter the relation name to see contents:   ")
        b=cursor.execute(f"select * from {relationname}")
        print(tabulate(b))
Littlefoot
  • 131,892
  • 15
  • 35
  • 57
Sai Manjunath
  • 1
  • I suppose the error is raised when you choose '2'. So, instead of putting the f"..." in the execute, assign it to a variable and print it before, just to see if the statement does not include some strange characters. – gsalem May 02 '22 at 10:02
  • (i) Don't share passwords and connection strings (ii) Make sure relationname has the name of a table - try `print(f"select * from {relationname}")`. (iii) Add some validation to check that relationname is *only* a name and not some other bits of SQL, otherwise you have a SQL Injection security vulnerability. – Christopher Jones May 02 '22 at 22:08

0 Answers0