{"record":{"id":"546b722f247042cf","repo":"geekcomputers/Python","slug":"invalid-employee-field","errorCode":null,"errorMessage":"Invalid employee field","messagePattern":"Invalid employee field","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"bank_managment_system/backend.py","lineNumber":70,"sourceCode":"    def create_employee(self, name, password, salary, position):\n        self.cur.execute(\n            \"INSERT INTO staff VALUES (?, ?, ?, ?)\", (name, password, salary, position)\n        )\n        self.conn.commit()\n\n    def check_employee(self, name, password):\n        self.cur.execute(\n            \"SELECT 1 FROM staff WHERE name=? AND pass=?\", (name, password)\n        )\n        return self.cur.fetchone() is not None\n\n    def show_employees(self):\n        self.cur.execute(\"SELECT name, salary, position FROM staff\")\n        return self.cur.fetchall()\n\n    def update_employee(self, field, new_value, name):\n        if field not in {\"name\", \"pass\", \"salary\", \"position\"}:\n            raise ValueError(\"Invalid employee field\")\n        self.cur.execute(f\"UPDATE staff SET {field}=? WHERE name=?\", (new_value, name))\n        self.conn.commit()\n\n    def check_name_in_staff(self, name):\n        self.cur.execute(\"SELECT 1 FROM staff WHERE name=?\", (name,))\n        return self.cur.fetchone() is not None\n\n    # ----------------- Customer -----------------\n    def create_customer(self, name, age, address, balance, acc_type, mobile_number):\n        acc_no = self.acc_no\n        self.cur.execute(\n            \"INSERT INTO bank VALUES (?, ?, ?, ?, ?, ?, ?)\",\n            (acc_no, name, age, address, balance, acc_type, mobile_number),\n        )\n        self.conn.commit()\n        self.acc_no += 1\n        return acc_no\n","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/geekcomputers/Python/blob/40f4cd2652d75ef8e49d76e5c4d431d458712719/bank_managment_system/backend.py#L52-L88","documentation":"This ValueError is raised by the bank management system's update_employee method when the requested database column is not in the allowed whitelist {name, pass, salary, position} for the staff table. Because the method builds SQL via f-string interpolation of the column name (which cannot be parameterized), the whitelist doubles as SQL-injection protection; any other field string is rejected before the UPDATE executes.","triggerScenarios":"Calling update_employee('emplyee_name', ..., name) (typo), update_employee('id', ...), or passing a user-typed or dynamically built field name not exactly matching one of the four allowed strings. The check is case-sensitive and exact-match against the set.","commonSituations":"Frontend dropdown/combo box values drifting out of sync with backend whitelisted names, typos in field names, adding a new staff column without updating the whitelist, or user-supplied input passed through as the field.","solutions":["Use exactly one of: 'name', 'pass', 'salary', 'position' (case-sensitive)","Fix typos in the caller and keep frontend option keys synchronized with the whitelist","If a new column is legitimately needed, add it to both the staff table schema and the whitelist set","Check the whitelist exception message against your calling code's literal string"],"exampleFix":"# before\nbackend.update_employee('salaryy', 50000, 'Alice')  # ValueError\n\n# after\nbackend.update_employee('salary', 50000, 'Alice')","handlingStrategy":"validation","validationCode":"VALID_EMPLOYEE_FIELDS = {'name', 'pass', 'salary', 'position'}\nif field in VALID_EMPLOYEE_FIELDS:\n    backend.update_employee(field, new_value, name)","typeGuard":"def is_valid_employee_field(field) -> bool:\n    return field in {'name', 'pass', 'salary', 'position'}","tryCatchPattern":"try:\n    backend.update_employee(field, new_value, name)\nexcept ValueError as e:\n    print(f'Rejected field update: {e}')","preventionTips":["Centralize whitelisted field names as a shared constant used by both frontend and backend","Expose update methods per field (update_salary, update_name) instead of accepting raw strings","Never pass user-typed input directly as the field argument"],"tags":["python","sql","validation","whitelist","backend"],"backgroundTag":"invalid-field-name","analyzedSha":"40f4cd2652d75ef8e49d76e5c4d431d458712719","analyzedAt":"2026-08-27T11:12:20.313Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}