TypeError: coercing to Unicode: need string or buffer, sqlite3.Cursor found

Question

I am building a Python web app using Flask and SQLite as the DB.

I get the above error when I attempt to login and validate user info from the database. My other database form inputs work and I am able to update and select data, so the database exists and the connection works in some parts of the app. The login script seems to be the issue.

@app.route('/login', methods=['POST', 'GET'])
def do_admin_login():
if request.method == "POST":
u_stmt="SELECT CASE WHEN '"+ request.form['username'] +"' IN (SELECT uname 
FROM logins) THEN 1 ELSE 0 END"  #uname in logins
p_stmt="SELECT pword FROM logins WHERE uname = '"+request.form['username']+"'"  
# retrieve pwd of uname
s_stmt="SELECT salt FROM logins WHERE uname = '"+request.form['username']+"'"  
# retrieve salt of uname
print u_stmt
print p_stmt
print s_stmt
with sql.connect("database.db") as con:
  cur = con.cursor()
  pwd = cur.execute(p_stmt)
  uname = cur.execute(u_stmt)
  salt = cur.execute(s_stmt)
  print uname
  print pwd
  print salt
  con.commit()
con.close()

hashed_password = hash_password(request.form['password'], salt)
if hashed_password == pwd and uname == 1:
    session['logged_in'] = True     
    flash('right password!')
    return render_template('home.html')
else:
    flash('wrong password!')
return home()
else:
return render_template('login.html')

Here is the code from my login.html

<form action="/login" method="POST">
<div class="login">
    <div class="login-screen">
        <div class="app-title">
            <h1>Login</h1>
        </div>

        <div class="login-form">
            <div class="control-group">
            <input type="text" class="login-field" value="" placeholder="username" name="username">
            <label class="login-field-icon fui-user" for="login-name"></label>
            </div>

            <div class="control-group">
            <input type="password" class="login-field" value="" placeholder="password" name="password">
            <label class="login-field-icon fui-lock" for="login-pass"></label>
            </div>

            <button type="submit" class="btn btn-primary btn-large btn-block">Log in</button>
            <br><br>
            <a href="signup" class="btn btn-primary btn-large btn-block">Sign up</a>
            <br><br>
        </div>
    </div>
</div>

Stacktrace (methinks)

Any help is greatly appreciated. Thank you!

def hash_password(password, salt):
"""
Take a password and a salt, and return a hashed password
"""
password_string = (password + salt).encode('utf-8')
hashed_password = hashlib.sha512(password_string).hexdigest()
return hashed_password


def get_auth_for_user(user_id):
"""
Take a user_id, and return what we know about that user
"""
db_cursor.execute("SELECT * FROM user WHERE id=" + user_id)
result = db_cursor.fetchone()
return result

Traceback with SQL output

Have you fetched the query after executing? Please include the code that threw the exception (line 13) and your script's output — cwahls
I have added the hash functions that threw the exception and I attached a second photo of the traceback that includes the output from the SQL — Buhlahkay

Reed Tomlinson Reed Tomlinson · Accepted Answer · 2018-05-21T15:20:04

The primary issue here is that you're trying to coerce a sqlite3.Cursor object to unicode.

The statement salt = cur.execute(s_stmt) returns a sqlite3.Cursor object (note that the output of the statement print salt is <sqlite3.Cursor object at 0x1048e1500> in your logs).

Change this line: salt = cur.execute(s_stmt)

to this: salt_query = curs.execute(s_stmt) salt = curs.fetchone()[0]

The last line gets the result from the table, and gets the value of the first column. That value will be a string instead of a SQLite cursor.

TypeError: coercing to Unicode: need string or buffer, sqlite3.Cursor found

1 Answers