Getting safe user input in python

Question

I'm writing a script that needs some very simple input from the user, and upon doing my research on this I am in a dilemma trying to work out the safest way to do it.

I only want an integer and stumbled across (what I thought was) a nice piece of code similar to (doing this from memory):

def getNumeric(prompt):
  while True:
    response = input(prompt)
    try:
      return int(response)
    except ValueError:
      print "please enter a number:",

This mostly worked, but if the user just pressed [enter] then it crashed. Turns out, I'm using python < 3, and the author wrote this for 3+. So now I have to rewrite for 2.7 to suit my needs. But how do I write it to cater for EITHER platform <3 and 3+?

I am writing something that could be used by others and want to make it the most portable I can. Should I bother?

As an aside, I am doing this for the Raspberry Pi, should I upgrade my python to 3, or leave it where it is (2.7.3)?

try changing 'input(prompt)' to 'raw_input(prompt)'.

alexpinho98
– alexpinho98

2013-07-20 10:58:13 +00:00
Commented Jul 20, 2013 at 10:58 — alexpinho98
– alexpinho98, Commented Jul 20, 2013 at 10:58

TerryA · Accepted Answer · 2020-06-16 09:12:31Z

6

My suggestion is to upgrade the Pi to Python 3. There's no point developing Python code for two separate versions (unless it's a library, which you'd use much more precautions than just sharing functions). You can do:

# Python 3.x
def getNumeric(prompt):
    while True:
        try:
            res = int(input(prompt))
            break
        except ValueError:
            print("Numbers only please!")
    return res

For Python 2.7.x, use raw_input() instead of input(). input() in Python 2 is not considered save since it evaluates the string given (and can be malicious).

edited Jun 16, 2020 at 9:12

answered Jul 20, 2013 at 10:05

TerryA

60.2k11 gold badges122 silver badges148 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Madivad Over a year ago

Text and Numbers work great, but in 2.7 (3 untested), if the user hits enter without any input I get:

Madivad Over a year ago

SyntaxError: unexpected EOF while parsing

Madivad Over a year ago

fixed (in 2.7) if I use raw_input. Thanks

hynekcer Over a year ago

The command input() is not safe in Python 2, because it evaluates the input string. It can also create a new program or run any program. It is not worse than an access to the console, but unsafe e.g. if the input is redirected remotely. An example of input __import__('os').system('sh')

TerryA Over a year ago

@hynekcer Yea agreed, I'm going to change this (almost) 7 year old answer

Viren Rajput · Accepted Answer · 2013-07-20 09:49:00Z

0

Try:

def getNumeric(prompt):
  while True:
    response = input(prompt)
    try:
      if isinstance(response, int):
          return int(response)
      else:
          print "please enter a number:"
    except ValueError:
      print "please enter a number:"

answered Jul 20, 2013 at 9:49

Viren Rajput

5,8965 gold badges33 silver badges41 bronze badges

1 Comment

Olivier Over a year ago

Apart from the compulsory parentheses to put around the arguments of the print functions, it doesn't work with Python 3.X, since input() always yields a string.

Collectives™ on Stack Overflow

Getting safe user input in python

2 Answers 2

5 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related