Question

I am trying to add to an API a DELETE method as follows:

if request.method == 'DELETE':

    if request.headers['Content-Type'] == 'application/json':

        try:
            data = json.loads(request.data)
            data_id = data['id']
            db.execute('DELETE FROM places WHERE id=' + data_id)
            db.commit()
            resp = Response({"Delete Success!"}, status=200, mimetype='application/json')
            return resp

        except (ValueError, KeyError, TypeError):
            resp = Response({"JSON Format Error."}, status=400, mimetype='application/json')
            return resp

I am passing the following CURL:

curl -H "Content-type: applicaiton/json" -X DELETE http://localhost:5000/location -d '{"id":3}'

The try except block is failing for some reason. I am unable to detect what the issue is. Any ideas how I can debug this?

Answer 1

If you change

except (ValueError, KeyError, TypeError):
    resp = Response({"JSON Format Error."}, status=400, mimetype='application/json')
    return resp

to

except (ValueError, KeyError, TypeError) as error:
    print error
    resp = Response({"JSON Format Error."}, status=400, mimetype='application/json')
    return resp

you will be able to see your error.

UPDATE: I’m glad you found your error! I think most modules that wrap database connections allow you to do something like:

db.execute('SELECT * FROM awesome_table WHERE id=%s', data_id)

and they will typically offer some basic SQL injection protection.