geekcomputers/Python · error · ValueError

Invalid employee field

Error message

Invalid employee field

What it means

This ValueError is raised by the bank management system's update_employee method when the requested database column is not in the allowed whitelist {name, pass, salary, position} for the staff table. Because the method builds SQL via f-string interpolation of the column name (which cannot be parameterized), the whitelist doubles as SQL-injection protection; any other field string is rejected before the UPDATE executes.

Source

Thrown at bank_managment_system/backend.py:70

    def create_employee(self, name, password, salary, position):
        self.cur.execute(
            "INSERT INTO staff VALUES (?, ?, ?, ?)", (name, password, salary, position)
        )
        self.conn.commit()

    def check_employee(self, name, password):
        self.cur.execute(
            "SELECT 1 FROM staff WHERE name=? AND pass=?", (name, password)
        )
        return self.cur.fetchone() is not None

    def show_employees(self):
        self.cur.execute("SELECT name, salary, position FROM staff")
        return self.cur.fetchall()

    def update_employee(self, field, new_value, name):
        if field not in {"name", "pass", "salary", "position"}:
            raise ValueError("Invalid employee field")
        self.cur.execute(f"UPDATE staff SET {field}=? WHERE name=?", (new_value, name))
        self.conn.commit()

    def check_name_in_staff(self, name):
        self.cur.execute("SELECT 1 FROM staff WHERE name=?", (name,))
        return self.cur.fetchone() is not None

    # ----------------- Customer -----------------
    def create_customer(self, name, age, address, balance, acc_type, mobile_number):
        acc_no = self.acc_no
        self.cur.execute(
            "INSERT INTO bank VALUES (?, ?, ?, ?, ?, ?, ?)",
            (acc_no, name, age, address, balance, acc_type, mobile_number),
        )
        self.conn.commit()
        self.acc_no += 1
        return acc_no

View on GitHub (pinned to 40f4cd2652)

Solutions

1. Use exactly one of: 'name', 'pass', 'salary', 'position' (case-sensitive)
2. Fix typos in the caller and keep frontend option keys synchronized with the whitelist
3. If a new column is legitimately needed, add it to both the staff table schema and the whitelist set
4. Check the whitelist exception message against your calling code's literal string

Example fix

# before
backend.update_employee('salaryy', 50000, 'Alice')  # ValueError

# after
backend.update_employee('salary', 50000, 'Alice')

VALID_EMPLOYEE_FIELDS = {'name', 'pass', 'salary', 'position'}
if field in VALID_EMPLOYEE_FIELDS:
    backend.update_employee(field, new_value, name)

def is_valid_employee_field(field) -> bool:
    return field in {'name', 'pass', 'salary', 'position'}

try:
    backend.update_employee(field, new_value, name)
except ValueError as e:
    print(f'Rejected field update: {e}')

When it happens

Trigger: Calling update_employee('emplyee_name', ..., name) (typo), update_employee('id', ...), or passing a user-typed or dynamically built field name not exactly matching one of the four allowed strings. The check is case-sensitive and exact-match against the set.

Common situations: Frontend dropdown/combo box values drifting out of sync with backend whitelisted names, typos in field names, adding a new staff column without updating the whitelist, or user-supplied input passed through as the field.

Related errors

• Invalid customer field
• Please give a integer
• Your integer should bigger than 0
• Invalid beta parameter at index 0: {betas[0]}
• Invalid beta parameter at index 1: {betas[1]}

AI-assisted analysis of geekcomputers/Python@40f4cd2652 (2026-08-27). Data as JSON: /api/errors/546b722f247042cf. Report an issue: GitHub.