geekcomputers/Python · error · ValueError

Invalid customer field

Error message

Invalid customer field

What it means

This ValueError is raised by update_customer when the requested column for the bank table is not in the allowed whitelist {name, age, address, mobile_number, account_type}. As with the staff updater, the column name is interpolated into an f-string SQL statement (column identifiers cannot be bound as SQL parameters), so the whitelist serves both validation and SQL-injection defense; balance updates must go through update_balance instead.

Source

Thrown at bank_managment_system/backend.py:103

        self.conn.commit()
        self.acc_no += 1
        return acc_no

    def check_acc_no(self, acc_no):
        self.cur.execute("SELECT 1 FROM bank WHERE acc_no=?", (acc_no,))
        return self.cur.fetchone() is not None

    def get_details(self, acc_no):
        self.cur.execute("SELECT * FROM bank WHERE acc_no=?", (acc_no,))
        return self.cur.fetchone()

    def get_detail(self, acc_no):
        self.cur.execute("SELECT name, balance FROM bank WHERE acc_no=?", (acc_no,))
        return self.cur.fetchone()

    def update_customer(self, field, new_value, acc_no):
        if field not in {"name", "age", "address", "mobile_number", "account_type"}:
            raise ValueError("Invalid customer field")
        self.cur.execute(
            f"UPDATE bank SET {field}=? WHERE acc_no=?", (new_value, acc_no)
        )
        self.conn.commit()

    def update_balance(self, amount, acc_no):
        self.cur.execute(
            "UPDATE bank SET balance = balance + ? WHERE acc_no=?", (amount, acc_no)
        )
        self.conn.commit()

    def deduct_balance(self, amount, acc_no):
        self.cur.execute("SELECT balance FROM bank WHERE acc_no=?", (acc_no,))
        bal = self.cur.fetchone()
        if bal and bal[0] >= amount:
            self.cur.execute(
                "UPDATE bank SET balance=balance-? WHERE acc_no=?", (amount, acc_no)
            )

View on GitHub (pinned to 40f4cd2652)

Solutions

1. Use only: 'name', 'age', 'address', 'mobile_number', 'account_type'
2. For balance changes, call update_balance(amount, acc_no) so the change goes through the proper path
3. Align frontend field identifiers with the whitelist and fix typos
4. If adding a new editable column, update both schema and whitelist

Example fix

# before
backend.update_customer('balance', 999999, '12345')  # ValueError

# after
backend.update_balance(999999, '12345')  # via proper transaction API

VALID_CUSTOMER_FIELDS = {'name', 'age', 'address', 'mobile_number', 'account_type'}
if field == 'balance':
    backend.update_balance(new_value, acc_no)
elif field in VALID_CUSTOMER_FIELDS:
    backend.update_customer(field, new_value, acc_no)

def is_valid_customer_field(field) -> bool:
    return field in {'name', 'age', 'address', 'mobile_number', 'account_type'}

try:
    backend.update_customer(field, new_value, acc_no)
except ValueError as e:
    print(f'Rejected customer field update: {e}')

When it happens

Trigger: Calling update_customer('balance', ...) (balance is deliberately excluded to force use of update_balance for transactional accounting), update_customer('acc_no', ...), or any typo/dynamically generated field name outside the exact set.

Common situations: Attempting to modify balance directly instead of via deposit/withdraw flows, frontend form field keys not matching backend names (e.g., 'mobile' vs 'mobile_number'), or renaming columns in the schema without updating the whitelist.

Related errors

• Invalid employee field
• Please give a integer
• Your integer should bigger than 0
• Invalid beta parameter at index 0: {betas[0]}
• Invalid beta parameter at index 1: {betas[1]}

AI-assisted analysis of geekcomputers/Python@40f4cd2652 (2026-08-27). Data as JSON: /api/errors/e4bd5d097c762bb6. Report an issue: GitHub.