Re: [Tutor] dealing with user input whose value I don't know

2008-10-05 Thread Omer
On Fri, Oct 3, 2008 at 9:45 AM, David [EMAIL PROTECTED] wrote:

 Here is the code:

 def main():
   import string


Hey,
lagging a bit behind the list,

import string is unnecessary, mate.
___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-05 Thread Alan Gauld


Omer [EMAIL PROTECTED] wrote 


Here is the code:

def main():
  import string


import string is unnecessary, mate.


Not entirely true since the code uses string.split()
However since the split method of the string could 
be used instead then that would indeed render the 
import unnecessary. But you need both changes.


Alan G

___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-03 Thread David

Hello Alan, dear list members,

Alan Gauld wrote:

The solution you have already seen - use string.split(',') to separate
the string into substrings and then convert each substring to an
integer.
This I have now done by using eval(). But now I wonder whether that is 
actually clever because it is supposed to be similarly problematic as 
the input() function in terms of security. Alternatively I could use 
int() -- would that be the way forward?


Here is the code:

def main():
   import string

   print This program takes the average of numbers you supply!!

   amount = raw_input(How many numbers do you want me to work with? )
   print You want me to take the average of, amount, numbers.

   numbers = raw_input(Please type the numbers, separated by commas: )
   print You want to know the average of the numbers:, numbers

   add = 0
   for numStr in string.split(numbers, ,):
   convNum = eval(numStr) # convert digit string to a number
   add = add + convNum # add number to variable 'add'
   print The sum of your numbers is:, add
   average = add / float(amount)
   print Therefore the average of your numbers is, average
main() 



Many thanks,

David

___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-03 Thread Alan Gauld


David [EMAIL PROTECTED] wrote


the string into substrings and then convert each substring to an
integer.
This I have now done by using eval(). But now I wonder whether that 
is actually clever because it is supposed to be similarly 
problematic as the input() function in terms of security.


Absolutely. The more open and general you make your code
the more opportunity you provide for attacks. Converting to
int/float is much safer.

--
Alan Gauld
Author of the Learn to Program web site
http://www.freenetpages.co.uk/hp/alan.gauld 



___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread Luke Paireepinart
On Thu, Oct 2, 2008 at 12:06 PM, David [EMAIL PROTECTED] wrote:
 Hello,

 I am trying to do some exercises in John Zelle's book (chapter 4).
 I got stuck:

 Write a program that finds the average of a series of numbers entered by
 the user. The program should first ask the user how many numbers there are.
 Note: the average should always be a float, even if the user inputs are all
 ints.

 Okay, I can ask how many number are to be added:

 numbers = input(How many number do you want me to calculate? )

 If I then get a reply, say 5, what I would have to do next is to ask for
 the five numbers so that I can calculate the average.
 But given that I don't know the the value of 'numbers' ex ante, how could I
 ask for the right amount of numbers?
 I don't see how this can be achieved with the tools I have learned so far...
 I am currently thinking along the lines of

 ans1, ans2 = input(Enter the numbers separated by a comma: )
 average = (ans1 + ans2) / 2.0

 But as I say - I don't know how many assignment there have to be, nor do I
 know how Python could then create these assignments.

This is a common issue beginners to programming have.
The question you ask yourself here is  do I really need a direct
reference in code to all my values?
It appears to me that you don't.
For example, how would you do this in real life?
would you say
x = num1
x2 = num2
x3 = num3
 ...
xn = numn

x + x2 + x3 + x4 ... + xn / n

or would you do this:

1 + 2 + 3 + 4 + 5 / count

I would do the latter.
It's the same way in programming.

You can create these generic collections of items in Python.  They are
called lists.
I'm a little pressed for time (i have a class starting in a few
minutes) but this example should hopefully spark something in 'ya.

a = []
b = [1,2,3,4,5]
for item in b:
   a.append(item)

Does that give you a hint about how you can add items to a collection
without caring how many you have?
Note that you can also do something like this (this is a bigger hint)
a = []
b = [1,2,3,4,5]
for i in range(len(b)):
a.append(b[i])

Good luck!


 It would be great if someone could guide me towards the right track!!

 Thanks,

 David
 ___
 Tutor maillist  -  Tutor@python.org
 http://mail.python.org/mailman/listinfo/tutor

___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread Steve Willoughby
On Fri, Oct 03, 2008 at 01:06:29AM +0800, David wrote:
 Hello,
 
 I am trying to do some exercises in John Zelle's book (chapter 4).
 I got stuck:
 
 Okay, I can ask how many number are to be added:
 
 numbers = input(How many number do you want me to calculate? )
 
 If I then get a reply, say 5, what I would have to do next is to ask 
 for the five numbers so that I can calculate the average.
 But given that I don't know the the value of 'numbers' ex ante, how 
 could I ask for the right amount of numbers?

You don't need to know in advance what the value of numbers 
will be.  You can have Python iterate number times, asking
for an additional number each time.

You could add each to a variable (so it accumulates the sum
as you iterate) and then divide by number.  You could collect
everything in a list and then do the calculation.

There's a couple of ideas.  See where that leads you and let
us know.


-- 
Steve Willoughby|  Using billion-dollar satellites
[EMAIL PROTECTED]   |  to hunt for Tupperware.
___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread christopher . henk
[EMAIL PROTECTED] wrote on 
10/02/2008 01:06:29 PM:

 Hello,
 
 I am trying to do some exercises in John Zelle's book (chapter 4).
 I got stuck:
 
 Write a program that finds the average of a series of numbers entered 
 by the user. The program should first ask the user how many numbers 
 there are. Note: the average should always be a float, even if the user 
 inputs are all ints.
 
 Okay, I can ask how many number are to be added:
 
 numbers = input(How many number do you want me to calculate? )

you should really use raw_input to get the info from the user, and 
then convert it to a number.
numbers=int(raw_input(How many number do you want me to 
calculate? ))

 
 If I then get a reply, say 5, what I would have to do next is to ask 
 for the five numbers so that I can calculate the average.

Write the code like you knew it was going to be a 5 and then 
replace anywhere the 5 appears with the variable 'numbers'.



 But given that I don't know the the value of 'numbers' ex ante, how 
 could I ask for the right amount of numbers?
 I don't see how this can be achieved with the tools I have learned so 
far...

Looking at the table of contents it looks like you should have 
learned about loops by now.



 I am currently thinking along the lines of
 
 ans1, ans2 = input(Enter the numbers separated by a comma: )
 average = (ans1 + ans2) / 2.0

have each number be its own input and repeat it depending on how 
their input for numbers, and then do the averaging at the end.

 
 But as I say - I don't know how many assignment there have to be, nor do 

 I know how Python could then create these assignments.
 
you don't need to keep the individual numbers only the sum, but if 
you want to, use a list and append each new number to the end of the list.

 It would be great if someone could guide me towards the right track!!
 
 Thanks,
 
 David
 ___
 Tutor maillist  -  Tutor@python.org
 http://mail.python.org/mailman/listinfo/tutor
___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread David

Hello Christopher,

[EMAIL PROTECTED] wrote:


 
  Okay, I can ask how many number are to be added:
 
  numbers = input(How many number do you want me to calculate? )

you should really use raw_input to get the info from the user, 
and then convert it to a number.
numbers=int(raw_input(How many number do you want me to 
calculate? ))


Does that mean input() is obsolete (after all, Zelle's book is not the 
freshest on the shelf)? Or do they have different uses?


Thanks,

David
___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread Steve Willoughby
On Fri, Oct 03, 2008 at 01:38:48AM +0800, David wrote:
 Does that mean input() is obsolete (after all, Zelle's book is not the 
 freshest on the shelf)? Or do they have different uses?

Depends on how you look at it.

input() automatically evaluates whatever the user types as a Python
expression and returns the result.  So if they type 5, the integer
5 is returned.  For your program, that's probably what you want, and
has the advantage of letting you type something like 2+3 so your user
can let Python evaluate math expressions.

On the other hand, you'd think that you could ask a user for a text
response using input():
   name = input(What is your name? )
   print Hello, , name

But if they just type the answer, Python will crash with an error
because it's expecting a legal Python expression there (so a 
string value would have to be typed in quotes).

However, raw_input() will just return the characters the user typed
without doing anything to them.  Great for string values, but this
means to get an integer result you'll have to pass that into the
int() constructor function.

IIRC Python 3.0 will actually make input() do what raw_input() today
does, because this is confusing to people as it stands now.

-- 
Steve Willoughby|  Using billion-dollar satellites
[EMAIL PROTECTED]   |  to hunt for Tupperware.
___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread Bill Campbell
On Thu, Oct 02, 2008, Steve Willoughby wrote:
On Fri, Oct 03, 2008 at 01:38:48AM +0800, David wrote:
 Does that mean input() is obsolete (after all, Zelle's book is not the 
 freshest on the shelf)? Or do they have different uses?

Depends on how you look at it.

input() automatically evaluates whatever the user types as a Python
expression and returns the result.  So if they type 5, the integer
5 is returned.  For your program, that's probably what you want, and
has the advantage of letting you type something like 2+3 so your user
can let Python evaluate math expressions.

On the other hand, you'd think that you could ask a user for a text
response using input():
   name = input(What is your name? )
   print Hello, , name

But if they just type the answer, Python will crash with an error
because it's expecting a legal Python expression there (so a 
string value would have to be typed in quotes).

Remember the cardinal rule NEVER TRUST USER INPUT!  Always check
for validity, and use methods that prevent malicious strings from
allowing the user to get unauthorized access or change things
they shouldn't.

Many of the common exploits of web pages are the result of poor
checking of input resulting in sql injection attacks, and other
breaches.

Bill
-- 
INTERNET:   [EMAIL PROTECTED]  Bill Campbell; Celestial Software LLC
URL: http://www.celestial.com/  PO Box 820; 6641 E. Mercer Way
Voice:  (206) 236-1676  Mercer Island, WA 98040-0820
Fax:(206) 232-9186

There are three kinds of men. The ones that learn by reading. The few who
learn by observation.  The rest of them have to pee on the electric fence
for themselves. -- Will Rogers
___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread David

Cheers for the insights!

However, I just found out that changing input() to raw_input() breaks my 
code:


This program takes the average of numbers you supply!!
How many numbers do you want me to work with? 2
You want me to take the average of 2 numbers.
Please type the numbers, separated by commas: 1,2
You want to know the average of the numbers: 1,2
Traceback (most recent call last):
 File avgInput.py, line 13, in module
   add = add + i
TypeError: unsupported operand type(s) for +: 'int' and 'str'

 End of process output 

The reason being, I take, that

numbers = raw_input(Please type the numbers, separated by commas: )

also returns the comma (1,2) and thus the for loop can't cope...
So should I therefore retain

numbers = input(Please type the numbers, separated by commas: ) ?

Otherwise I don't know (yet) what to do

David


Bill Campbell wrote:

On Thu, Oct 02, 2008, Steve Willoughby wrote:
  

On Fri, Oct 03, 2008 at 01:38:48AM +0800, David wrote:

Does that mean input() is obsolete (after all, Zelle's book is not the 
freshest on the shelf)? Or do they have different uses?
  

Depends on how you look at it.

input() automatically evaluates whatever the user types as a Python
expression and returns the result.  So if they type 5, the integer
5 is returned.  For your program, that's probably what you want, and
has the advantage of letting you type something like 2+3 so your user
can let Python evaluate math expressions.

On the other hand, you'd think that you could ask a user for a text
response using input():
  name = input(What is your name? )
  print Hello, , name

But if they just type the answer, Python will crash with an error
because it's expecting a legal Python expression there (so a 
string value would have to be typed in quotes).



Remember the cardinal rule NEVER TRUST USER INPUT!  Always check
for validity, and use methods that prevent malicious strings from
allowing the user to get unauthorized access or change things
they shouldn't.

Many of the common exploits of web pages are the result of poor
checking of input resulting in sql injection attacks, and other
breaches.

Bill
  


___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread Steve Willoughby
On Thu, Oct 02, 2008 at 10:54:56AM -0700, Bill Campbell wrote:
 Remember the cardinal rule NEVER TRUST USER INPUT!  Always check
 for validity, and use methods that prevent malicious strings from
 allowing the user to get unauthorized access or change things
 they shouldn't.

Yes, I probably should have qualified what I said.  This is
VERY important.  Should you ever allow input() or other eval()
of what the user typed (or for that matter, passing what the
user types into file operations, SQL queries, etc)?  Yes, but
*only* if you are *certain* you *must* and that you know exactly
what you're doing.  And probably not even then if you can 
avoid it.

So the point was what the difference was between raw_input()
and input(), but Bill's right, don't just use input() or
eval() (and input() is essentially eval(raw_input())) casually.

Not sure why?

Suppose you put a program up for public use which gets a
string value using input().  Instead of

  How many numbers? 5

the user types:

  How many numbers? os.system('rm -rf /')

Don't ever assume data is safe or valid if it came from 
outside your realm of control.

(And don't fool yourself that a script is just for me, in 
most environments things get reused in ways you don't expect, 
and even if not, get used to good programming habits).

-- 
Steve Willoughby|  Using billion-dollar satellites
[EMAIL PROTECTED]   |  to hunt for Tupperware.
___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread Steve Willoughby
On Fri, Oct 03, 2008 at 02:06:47AM +0800, David wrote:
 Cheers for the insights!
 
 However, I just found out that changing input() to raw_input() breaks my 
 code:

Recall that we told you raw_input() returns a string, while
input() returns an integer if you typed an integer value.

So you need to convert the string of characters the user typed
into an integer value before using it as a number:

numbers = int(raw_input(...))


 
 This program takes the average of numbers you supply!!
 How many numbers do you want me to work with? 2
 You want me to take the average of 2 numbers.
 Please type the numbers, separated by commas: 1,2
 You want to know the average of the numbers: 1,2
 Traceback (most recent call last):
  File avgInput.py, line 13, in module
add = add + i
 TypeError: unsupported operand type(s) for +: 'int' and 'str'
 
  End of process output 
 
 The reason being, I take, that
 
 numbers = raw_input(Please type the numbers, separated by commas: )
 
 also returns the comma (1,2) and thus the for loop can't cope...
 So should I therefore retain
 
 numbers = input(Please type the numbers, separated by commas: ) ?
 
 Otherwise I don't know (yet) what to do
 
 David
 
 
 Bill Campbell wrote:
 On Thu, Oct 02, 2008, Steve Willoughby wrote:
   
 On Fri, Oct 03, 2008 at 01:38:48AM +0800, David wrote:
 
 Does that mean input() is obsolete (after all, Zelle's book is not the 
 freshest on the shelf)? Or do they have different uses?
   
 Depends on how you look at it.
 
 input() automatically evaluates whatever the user types as a Python
 expression and returns the result.  So if they type 5, the integer
 5 is returned.  For your program, that's probably what you want, and
 has the advantage of letting you type something like 2+3 so your user
 can let Python evaluate math expressions.
 
 On the other hand, you'd think that you could ask a user for a text
 response using input():
   name = input(What is your name? )
   print Hello, , name
 
 But if they just type the answer, Python will crash with an error
 because it's expecting a legal Python expression there (so a 
 string value would have to be typed in quotes).
 
 
 Remember the cardinal rule NEVER TRUST USER INPUT!  Always check
 for validity, and use methods that prevent malicious strings from
 allowing the user to get unauthorized access or change things
 they shouldn't.
 
 Many of the common exploits of web pages are the result of poor
 checking of input resulting in sql injection attacks, and other
 breaches.
 
 Bill
   
 
 ___
 Tutor maillist  -  Tutor@python.org
 http://mail.python.org/mailman/listinfo/tutor

-- 
Steve Willoughby|  Using billion-dollar satellites
[EMAIL PROTECTED]   |  to hunt for Tupperware.
___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread christopher . henk
I am not sure how you got from the input to your variable i, it is a good 
idea to post your code as well.

That said raw_input will return the user's input as a string which you 
then need to convert to integers.
So the commas are brought in as well.
You can solve this in a couple of ways:
First, you can split the string on the commas and get a list of strings 
each representing one of the numbers.

numberlist=numbers.splt(,)
will give you: 
numberslist=[1,2]
which you can then loop over and convert to integers and add up.

Secondly, you can have the users input the numbers one at a time inside 
the loop.
add = add + int(raw_input(Please type the next number:))

Chris





David [EMAIL PROTECTED] 
Sent by: [EMAIL PROTECTED]
10/02/2008 02:06 PM

To
tutor@python.org, 
[EMAIL PROTECTED]
cc

Subject
Re: [Tutor] dealing with user input whose value I don't know






Cheers for the insights!

However, I just found out that changing input() to raw_input() breaks my 
code:

This program takes the average of numbers you supply!!
How many numbers do you want me to work with? 2
You want me to take the average of 2 numbers.
Please type the numbers, separated by commas: 1,2
You want to know the average of the numbers: 1,2
Traceback (most recent call last):
  File avgInput.py, line 13, in module
add = add + i
TypeError: unsupported operand type(s) for +: 'int' and 'str'

 End of process output 

The reason being, I take, that

numbers = raw_input(Please type the numbers, separated by commas: )

also returns the comma (1,2) and thus the for loop can't cope...
So should I therefore retain

numbers = input(Please type the numbers, separated by commas: ) ?

Otherwise I don't know (yet) what to do

David


Bill Campbell wrote:
 On Thu, Oct 02, 2008, Steve Willoughby wrote:
 
 On Fri, Oct 03, 2008 at 01:38:48AM +0800, David wrote:
 
 Does that mean input() is obsolete (after all, Zelle's book is not the 

 freshest on the shelf)? Or do they have different uses?
 
 Depends on how you look at it.

 input() automatically evaluates whatever the user types as a Python
 expression and returns the result.  So if they type 5, the integer
 5 is returned.  For your program, that's probably what you want, and
 has the advantage of letting you type something like 2+3 so your user
 can let Python evaluate math expressions.

 On the other hand, you'd think that you could ask a user for a text
 response using input():
   name = input(What is your name? )
   print Hello, , name

 But if they just type the answer, Python will crash with an error
 because it's expecting a legal Python expression there (so a 
 string value would have to be typed in quotes).
 

 Remember the cardinal rule NEVER TRUST USER INPUT!  Always check
 for validity, and use methods that prevent malicious strings from
 allowing the user to get unauthorized access or change things
 they shouldn't.

 Many of the common exploits of web pages are the result of poor
 checking of input resulting in sql injection attacks, and other
 breaches.

 Bill
 

___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor

___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread David

Hello Steve,

thanks for all your help and comments.

What happens, though, is that with

numbers = int(raw_input(Please type the numbers, separated by commas: ))

my code is still defunct (whereas input() works):

Please type the numbers, separated by commas: 1,2
Traceback (most recent call last):
 File avgInput.py, line 8, in module
   numbers = int(raw_input(Please type the numbers, separated by 
commas: ))

ValueError: invalid literal for int() with base 10: '1,2'

 End of process output 


Here is the entire code:

print This program takes the average of numbers you supply!!
amount = raw_input(How many numbers do you want me to work with? )
print You want me to take the average of, amount, numbers.
numbers = int(raw_input(Please type the numbers, separated by commas: ))
print You want to know the average of the numbers:, numbers

add = 0
for i in numbers:
   add = add + i
print The sum of your numbers is:, add
average = add / float(amount)
print Therefore the average of your numbers is, average


David



Steve Willoughby wrote:

On Fri, Oct 03, 2008 at 02:06:47AM +0800, David wrote:
  

Cheers for the insights!

However, I just found out that changing input() to raw_input() breaks my 
code:



Recall that we told you raw_input() returns a string, while
input() returns an integer if you typed an integer value.

So you need to convert the string of characters the user typed
into an integer value before using it as a number:

numbers = int(raw_input(...))


  

This program takes the average of numbers you supply!!
How many numbers do you want me to work with? 2
You want me to take the average of 2 numbers.
Please type the numbers, separated by commas: 1,2
You want to know the average of the numbers: 1,2
Traceback (most recent call last):
 File avgInput.py, line 13, in module
   add = add + i
TypeError: unsupported operand type(s) for +: 'int' and 'str'

 End of process output 

The reason being, I take, that

numbers = raw_input(Please type the numbers, separated by commas: )

also returns the comma (1,2) and thus the for loop can't cope...
So should I therefore retain

numbers = input(Please type the numbers, separated by commas: ) ?

Otherwise I don't know (yet) what to do

David


Bill Campbell wrote:


On Thu, Oct 02, 2008, Steve Willoughby wrote:
 
  

On Fri, Oct 03, 2008 at 01:38:48AM +0800, David wrote:
   

Does that mean input() is obsolete (after all, Zelle's book is not the 
freshest on the shelf)? Or do they have different uses?
 
  

Depends on how you look at it.

input() automatically evaluates whatever the user types as a Python
expression and returns the result.  So if they type 5, the integer
5 is returned.  For your program, that's probably what you want, and
has the advantage of letting you type something like 2+3 so your user
can let Python evaluate math expressions.

On the other hand, you'd think that you could ask a user for a text
response using input():
 name = input(What is your name? )
 print Hello, , name

But if they just type the answer, Python will crash with an error
because it's expecting a legal Python expression there (so a 
string value would have to be typed in quotes).
   


Remember the cardinal rule NEVER TRUST USER INPUT!  Always check
for validity, and use methods that prevent malicious strings from
allowing the user to get unauthorized access or change things
they shouldn't.

Many of the common exploits of web pages are the result of poor
checking of input resulting in sql injection attacks, and other
breaches.

Bill
 
  

___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor



  


___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread David

Oh, great, this answers my question!

Thanks!

David


[EMAIL PROTECTED] wrote:


I am not sure how you got from the input to your variable i, it is a 
good idea to post your code as well.


That said raw_input will return the user's input as a string which you 
then need to convert to integers.

So the commas are brought in as well.
You can solve this in a couple of ways:
First, you can split the string on the commas and get a list of 
strings each representing one of the numbers.


numberlist=numbers.splt(,)
will give you:
numberslist=[1,2]
which you can then loop over and convert to integers and add up.

Secondly, you can have the users input the numbers one at a time 
inside the loop.

add = add + int(raw_input(Please type the next number:))

Chris




*David [EMAIL PROTECTED]*
Sent by: 
[EMAIL PROTECTED]


10/02/2008 02:06 PM


To
	tutor@python.org, 
[EMAIL PROTECTED]

cc

Subject
Re: [Tutor] dealing with user input whose value I don't know









Cheers for the insights!

However, I just found out that changing input() to raw_input() breaks my
code:

This program takes the average of numbers you supply!!
How many numbers do you want me to work with? 2
You want me to take the average of 2 numbers.
Please type the numbers, separated by commas: 1,2
You want to know the average of the numbers: 1,2
Traceback (most recent call last):
 File avgInput.py, line 13, in module
   add = add + i
TypeError: unsupported operand type(s) for +: 'int' and 'str'

 End of process output 

The reason being, I take, that

numbers = raw_input(Please type the numbers, separated by commas: )

also returns the comma (1,2) and thus the for loop can't cope...
So should I therefore retain

numbers = input(Please type the numbers, separated by commas: ) ?

Otherwise I don't know (yet) what to do

David


Bill Campbell wrote:
 On Thu, Oct 02, 2008, Steve Willoughby wrote:
  
 On Fri, Oct 03, 2008 at 01:38:48AM +0800, David wrote:

 Does that mean input() is obsolete (after all, Zelle's book is not 
the

 freshest on the shelf)? Or do they have different uses?
  
 Depends on how you look at it.


 input() automatically evaluates whatever the user types as a Python
 expression and returns the result.  So if they type 5, the integer
 5 is returned.  For your program, that's probably what you want, and
 has the advantage of letting you type something like 2+3 so your user
 can let Python evaluate math expressions.

 On the other hand, you'd think that you could ask a user for a text
 response using input():
   name = input(What is your name? )
   print Hello, , name

 But if they just type the answer, Python will crash with an error
 because it's expecting a legal Python expression there (so a
 string value would have to be typed in quotes).



 Remember the cardinal rule NEVER TRUST USER INPUT!  Always check
 for validity, and use methods that prevent malicious strings from
 allowing the user to get unauthorized access or change things
 they shouldn't.

 Many of the common exploits of web pages are the result of poor
 checking of input resulting in sql injection attacks, and other
 breaches.

 Bill
  


___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor



___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread Alan Gauld


David [EMAIL PROTECTED] wrote

However, I just found out that changing input() to raw_input() 
breaks my code:


You want to know the average of the numbers: 1,2
Traceback (most recent call last):
 File avgInput.py, line 13, in module
   add = add + i
TypeError: unsupported operand type(s) for +: 'int' and 'str'

 End of process output 

numbers = raw_input(Please type the numbers, separated by commas: 
)

numbers = input(Please type the numbers, separated by commas: ) ?


What is happening is a bit more subtle than you think. I think!...

As others have pointed out input() evaluates whatever the user types
as a python expression. Now a list of numbers separated by commas
is, to python, a tuple. So your input version stores the list of 
numbers

as a list(ie. a tuple!) whereas raw_input() stores a string containing
the list of comma separated values.

The solution you have already seen - use string.split(',') to separate
the string into substrings and then convert each substring to an
integer.

As an aside:
What you have done is actually quite a user friendly solution but
I suspect most programmers would have opted to use a loop.
Have you covered loops yet? Specifically a for loop? That would
allow you to read in really long lists of numbers and calculate
the sum as you go.

--
Alan Gauld
Author of the Learn to Program web site
http://www.freenetpages.co.uk/hp/alan.gauld 



___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor


Re: [Tutor] dealing with user input whose value I don't know

2008-10-02 Thread Alan Gauld


David [EMAIL PROTECTED] wrote

Does that mean input() is obsolete (after all, Zelle's book is not 
the freshest on the shelf)? Or do they have different uses?


They have different uses and input is very convenient at the  
prompt

or when experimenting but in most cases is the wrong choice for
'production'; code because of its vulnerability to exploitation by
crackers and other malicious (or unintentionally malign) users.

--
Alan Gauld
Author of the Learn to Program web site
http://www.freenetpages.co.uk/hp/alan.gauld



___
Tutor maillist  -  Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor