Question

I have nearly successfully made a query for MySQL via Python that shows the most frequent datasets given the brand. The problem I am having is when I try to run the print row[1], row[2] command, it returns productnum instead of the space I want like product num. I tried doing print row[1], " ", row[2] but it doesn’t satisfy the test cases. Is there another way to get around this problem. I know this may not sound like an important question but it has been bugging me and it is this problem that is not passing the tests. The full code is below.

Answer 1

Please don’t create your SQL by concatenating strings. Pretend I’m an attacker and I call your function like:

inject = "'; SELECT name,cardnum FROM credit_cards; --"
most_popular(inject, 'LOL')

Your code will helpfully expand that to:

SELECT DISTINCT brand, product, COUNT(*) AS num FROM table1 WHERE brand = ''; SELECT * FROM credit_cards; --'" "GROUP BY product ORDER BY num desc, product asc LIMIT LOL

and now your customers are suing you. Always, always use parameterized queries instead of building queries yourself. Change that cursor.execute() like to look like:

 cursor.execute("SELECT DISTINCT brand, product, COUNT(*) AS num FROM table1 WHERE brand = %s GROUP BY product ORDER BY num desc, product asc LIMIT %s", (brands, num_frequency))

I’ve been writing DB libraries for years and the idea of trying to get this stuff right still terrifies me, mainly because the penalties for screwing it up are so severe. Let your database library do the hard work for you.