Amit Khemka wrote: > Well actually the problem is I have a list of tuples which i cast as > string and then put in a html page as the value of a hidden variable. > And when i get the string again, i want to cast it back as list of tuples: > ex: > input: "('foo', 1, 'foobar', (3, 0)), ('foo1', 2, 'foobar1', (3, 1)), > ('foo2', 2, 'foobar2', (3, 2))" > output: [('foo', 1, 'foobar', (3, 0)), ('foo1', 2, 'foobar1', (3, 1)), > ('foo2', 2, 'foobar2', (3, 2))] > > I hope that explains it better...
what do you think happens if the user manipulates the field values so they contain, say os.system('rm -rf /') or "'*'*1000000*2*2*2*2*2*2*2*2*2" or something similar? if you cannot cache session data on the server side, I'd recommend inventing a custom record format, and doing your own parsing. turning your data into e.g. "foo:1:foobar:3:0+foo1:2:foobar1:3:1+foo2:2:foobar2:3:2" is trivial, and the resulting string can be trivially parsed by a couple of string splits and int() calls. to make things a little less obvious, and make it less likely that some character in your data causes problems for the HTML parser, you can use base64.encodestring on the result (this won't stop a hacker, of course, so you cannot put sensitive data in this field). </F> -- http://mail.python.org/mailman/listinfo/python-list