2ef4 Python security - trouble with input
Training, Open Source Computer Languages

Search for:
Print friendly page
Home Accessibility Courses Diary The Mouth Forum Resources Site Map About Us Contact
Python security - trouble with input

The danger of Python's input function - also known as giving away your secrets to your user.

If you're writing a Python program and asking your user for input, you should always use the raw_input function and never input. Why? Because what you type to input is interpretted through an expression and the result is saved into your target variable ... so not only does input assume that your user knows Python syntax, but it also opens some great little security holes.

Look at this program.

Something = "your toes"
Secret = "I have ten of them"

value = input("Please enter your age ")
print "You are",value,
print "and you have a secret about",Something

And look how easy it is to find out all the variables that are used inthe program, and their contents:

earth-wind-and-fire$ python dain
Please enter your age dir()
You are ['Secret', 'Something', '__builtins__', '__doc__', '__file__', '__name__'] and you have a secret about your toes
earth-wind-and-fire:$ python dain
Please enter your age Secret
You are I have ten of them and you have a secret about your toes
earth-wind-and-fire:$

First run ... find out what all the defined variables are called. Second run ... start reading those variables. Ouch!
(written 2006-11-30)

 
Associated topics are indexed under
Y102 - Python - Fundamentals
  [3917] BODMAS - the order a computer evaluates arithmetic expressions - (2012-11-09)
  [3886] Formatting output - why we need to, and first Python example - (2012-10-09)
  [3551] Some terms used in programming (Biased towards Python) - (2011-12-12)
  [3278] Do I need to initialise variables - programming in C, C++, Perl, PHP, Python, Ruby or Java. - (2011-05-05)
  [3181] Beware - a=a+b and a+=b are different - Python - (2011-02-23)
  [3083] Python - fresh examples from recent courses - (2010-12-11)
  [2778] Learning to program in Python 2 ... and / or in Python 3 - (2010-05-24)
  [2442] Variable storage - Perl, Tcl and Python compared - (2009-10-08)
  [2368] Python - fresh examples of all the fundamentals - (2009-08-20)
  [1878] Pascals Triangle in Python and Java - (2008-11-10)
  [1461] Python - input v raw input - (2007-12-06)
  [1448] Question on division (Java) - Also Perl, PHP, Python ... - (2007-11-28)
  [1430] Integer v float - Python - (2007-11-12)
  [748] Getting rid of variables after you have finished with them - (2006-06-06)
  [633] Copying a reference, or cloning - (2006-03-05)
  [328] Making programs easy for any user to start - (2005-05-29)


56e3
Back to
Python collections - mutable and imutable
 Previous and next
or
Horse's mouth home		 Forward to
Improving the historic town of Melksham
Some other Articles
1st, 2nd, 3rd revisited in Ruby
It's the 1st, not the 1nd 1rd or 1th.
Plain Ole nice pictures
Improving the historic town of Melksham
Python security - trouble with input
Python collections - mutable and imutable
Splitting Pythons in Bradford
Christmas in November
Coming from London to Melksham by train for a course
What happened at Geekmas
4084 posts, page by page
Link to page ... 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82 at 50 posts per page


This is a page archived from The Horse's Mouth at http://www.wellho.net/horse/ - the diary and writings of Graham Ellis. Every attempt was made to provide current information at the time the page was written, but things do move forward in our business - new software releases, price changes, new techniques. Please check back via our main site for current courses, prices, versions, etc - any mention of a price in "The Horse's Mouth" cannot be taken as an offer to supply at that price.

Link to Ezine home page (for reading).
Link to Blogging home page (to add comments).
You can Add a comment or ranking to this page
Public Training Courses
Running regularly at our UK training Centre.
[Schedule] - [About] - [Book]

Like this? ??

Related short articles
Python Properties - how and why
Identity in Python
Test Driven Development in Python - Customer Comes First
Quick and easy - showing Python data hander output via a browser
Some tips and techniques for huge data handling in Python
Python network programming - new FTP and socket level examples
Cacheing class for Python - using a local SQLite database as a key/value store
JSON from Python - first principles, easy example
Looking for Creative Design, Catering and Transport inputs to help with Melksham Campus
Exception, Lambda, Generator, Slice, Dict - examples in one Python program
Really Simple Class and Inheritance example in Python
Collections in Python - list tuple dict and string.
SQL databases from Python - an SQLite example
Spike solution, refactored and reusable, Python - Example
Reading and checking user inputs - first lessons - Ruby
Upcoming courses at Well House Manor - Ruby, Python, Perl
this or self - what are they, and what is the difference? (Python)
vargs in Python - how to call a method with unknown number of parameters
A long overdue meeting - a steeping stone towards coordinate transport user inputs
Whether you have programmed before or not, we can teach you Python
Multiple identical keys in a Python dict - yes, you can!
Optional positional and named parameters in Python
Reporting the full stack trace when you catch a Python exception
Filtering PHP form inputs - three ways, but which should you use?
How many times ... has this loco headed west through Tenby? - Python exceptions
How well do you know Perl and / or Python?
Python Programming class for delegates who have already self-taught the basics
Shell - Grep - Sed - Awk - Perl - Python - which to use when?
Inheritance, Composition and Associated objects - when to use which - Python example
Default local - a good choice by the author of Python
Static variables in Python?
Geekmas 2012 - celebrating open source languages such as Perl, PHP and Python
Know Python or PHP? Want to learn Perl too?
When you should use Object Orientation even in a short program - Python example
zip in Python
Backquote, backtic, str and repr in Python - conversion object to string
Python timing - when to use a list, and when to use a generator
Shell, Awk, Perl of Python?
Spike solutions and refactoring - a Python example
Learning to program - the if statement. Python.
Refresh and Revision training class days - Perl / PHP / Python / Lua / Ruby / Tcl / C / C++
Functions are first class variables in Lua and Python
Object oriented or structured - a comparison in Python. Also writing clean regular expressions
Kings Cross - new concourse - between Python in Cambridge and Objective C in London
Error checking in a Python program - making your program robust via exceptions
Finding all the unique lines in a file, using Python or Perl
Sessions (Shopping Carts) in Django - the Python Web Framework
Perl functions such as chop change their input parameters
Python or Lua - which should I use / learn?
Football league tables - under old and new point system. Python program.
Dark mornings, dog update, and Python and Lua courses before Christmas
December courses - PHP, Python, Perl - and a weekend Lua course
Metaclasses (Python) and Metatables (Lua)
Python - current versions and implementations (CPython, Jython, IronPython etc)
Melksham House / Melksham Campus - Seniors Input Sought
Python courses and Private courses - gently updating our product to keep it ahead of the game
Python sets and frozensets - what are they?
Practical Extraction and Reporting - using Python and Extreme Programming
Testing your Python classes with the unittest package - how to
Choosing your Python GUI - wx, Qt, Tk or GTK?
Tkinter - an easy to use Python Graphic User Interface - introductory examples
Python Packages - groupings of modules. An introduction
Python string formatting - the move from % to str.format
How can I do an FTP transfer in Python?
Passing optional and named parameters to python methods
A demonstration of how many Python facilities work together
Pressing ^C in a Python program. Also Progress Bar.
Python for loops - applying a temporary second name to the same object
Moving from scripting to Object Orientation in Python
Formatting output in Python through str.format
List slices in Python - 2 and 3 values forms, with an uplifting example
Passing parameters to Python functions - the options you have
All possible combinations from a list (Python) or array (Ruby)
Multiple inputs, multiple out, ruby functions
Melksham Campus - any last minute inputs from Melksham businesses?
Open Source (Public) courses - PHP, Tcl, SQL, Python, C and C++ in Melksham, Wiltshire, UK
Melksham Campus - what, why, questions, concerns and how you can input
Insurance against any errors - Volcanoes and Python
Rekeying a table - comparison in #Ruby #Perl and #Python
Disassembling Python and Java - previously compiled code
4a6
© WELL HOUSE CONSULTANTS LTD., 2013: Well House Manor • 48 Spa Road • Melksham, Wiltshire • United Kingdom • SN12 7NY
PH: 01144 1225 708225 • FAX: 01144 1225 899360 • EMAIL: info@wellho.net • WEB: http://www.wellho.net • SKYPE: wellho

PAGE: http://www.wellho.net/mouth/956_Pyth ... input.html • PAGE BUILT: Sat Feb 23 12:39:13 2013 • BUILD SYSTEM: wizard
0