Scribd
Upload
2 views7 pages

Document

The document outlines several limitations in a database application, including hardcoded credentials, SQL injection vulnerabilities, and lack of user input validation. It also suggests improvements such as using environment variables for credentials, implementing parameterized queries, and enhancing user feedback. Additional recommendations include adding error handling, connection pooling, and a web interface for better user experience.

Uploaded by

abhirupsarkar2jp
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
2 views7 pages

Document

The document outlines several limitations in a database application, including hardcoded credentials, SQL injection vulnerabilities, and lack of user input validation. It also suggests improvements such as using environment variables for credentials, implementing parameterized queries, and enhancing user feedback. Additional recommendations include adding error handling, connection pooling, and a web interface for better user experience.

Uploaded by

abhirupsarkar2jp
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 7

Limitations

1. Hardcoded Database Credentials:

Database credentials (host, user, password) are hardcoded, which is a security risk.

No error handling for database connection failures.

2. SQL Injection Vulnerability:

Queries use string formatting (.format()), making the application vulnerable to SQL injection attacks.

3. No Validation on User Input:

Inputs are taken directly without validation (e.g., name, city, type).

Invalid or malicious inputs could cause errors or unexpected behavior.

4. Case Sensitivity in Queries:

Queries like DELETE and SELECT are case-sensitive for name and city. This can lead to inconsistent
behavior.
5. No Error Handling:

Missing error handling for SQL execution, database connection issues, or invalid user input.

6. Redundant Database Connections:

Each function establishes and closes a database connection, which is inefficient.

7. Static Season Filtering:

The display_places_by_season function is hardcoded to filter only from October to February, limiting
flexibility.

8. Limited Feedback to Users:

Messages like "No places found" are generic and do not guide users to correct their input.

9. No Logging Mechanism:

The program lacks logging for debugging or tracking user actions.


10. Inefficient Data Display:

Outputs like print(i) display data in tuple format, which is not user-friendly.

11. Database Table Setup:

The setup_database function doesn't handle existing tables gracefully, potentially causing errors.

---

Improvements

1. Use Environment Variables for Credentials:

Store database credentials in environment variables or a configuration file.

2. Use Parameterized Queries:

Replace .format() with parameterized queries to prevent SQL injection:

cursor.execute("DELETE FROM tourism WHERE name = %s AND city = %s", (name, city))
3. Validate User Input:

Add validation to ensure inputs meet expected formats (e.g., non-empty strings, valid season
names).

4. Implement Case-Insensitive Queries:

Use LOWER() or ILIKE (in supported databases) to handle case insensitivity:

SELECT name FROM tourism WHERE LOWER(city) = LOWER(%s)

5. Add Error Handling:

Use try-except blocks to handle database connection and query errors gracefully.

6. Connection Pooling:

Use connection pooling to reduce overhead when repeatedly connecting to the database.

7. Dynamic Season Filtering:

Allow users to specify the start and end months dynamically instead of hardcoding them.
8. User-Friendly Output:

Format query results into readable strings:

print(f"Place: {place[0]}, City: {place[1]}")

9. Add Logging:

Use Python’s logging module to log errors, warnings, and user actions.

10. Graceful Table Setup:

Check if the table exists before attempting to create it:

cursor.execute("""

CREATE TABLE IF NOT EXISTS tourism (

Id INT AUTO_INCREMENT PRIMARY KEY,

Name VARCHAR(100),

City VARCHAR(100),

Type VARCHAR(50),

SeasonStart VARCHAR(50),

SeasonEnd VARCHAR(50),

HowToReach VARCHAR(50)

)
""")

11. Enhanced Menu Options:

Add an option to update tourism place details.

Provide a search feature for places by type or transport mode.

12. Data Display Optimization:

Use libraries like tabulate to display data in a tabular format:

from tabulate import tabulate

print(tabulate(places, headers=["Place Name", "City"]))

13. Feedback and Help Menu:

Add a help menu explaining valid inputs and functionality.

14. Add Testing:

Implement unit tests for each function to ensure reliability.


15. Web Interface:

Consider creating a web-based interface using frameworks like Flask or Django for a better user
experience.

You might also like