Django

[menator01]

I've been playing around with django a little. I've got everything working up to my progress point but, I've seem to hit a snag.
When landing on the home page the home link shows active. All main links show active as they are clicked.
On a submenu if the links are clicked I have them showing an active state. The goal is to get the first link to show active when landing on that page.
Any help or thoughts would be great.

Relevant code for view

def list_view(request, *args, **kwargs):
    letter = request.GET.get('letter')
    id = request.GET.get('id')
    con = sqlite3.connect('db.sqlite3')
    cur = con.cursor()
    cur.execute('select id,title from book_book where title like "' + letter + '%"')
    rows = cur.fetchall()
    con.close()
    info = []
    id_active = ''
    if not id:
        id = False
    for ids, titles in rows:
        if int(ids) == int(id):
            id_active = 'active'
        else:
            id_active = ''
        info.append((ids,titles,id_active))

    rowcount = len(rows)
    if len(rows) > 0:
        message = 'Listing ' + str(len(rows)) + ' results for ' + letter.title()
    else:
        message = 'Could not find any listing for ' + letter.title()
    context = {'isactive':'active', 'rows':info, 'letter':letter, 'message':message, 'rowcount':rowcount}
    return render(request, "book/list.html", context)

Relevant code for list.html

{% extends "book/base.html" %}

{% block content %}
<h1 class="myh1">{{message}}</h1>

{% if rowcount > 0 %}
<table class="mytable">
  <tr>
    <td class="td-left">
{{info}}
{% for row in rows %}
<a href="/listview?letter={{letter}}&id={{row.0}}" class="w-100 {{row.2}}  list-group-item list-group-item-action list-group-item-primary">{{row.1}}</a>
{% endfor %}
    </td>

    <td class="td-right">

    </td>
  </tr>
</table>
{% endif %}


{% endblock content %}

[menator01]

The goal

[Image: first.PNG]
[Image: second.PNG]
[Image: last.PNG]

[ndc85430]

I've not really got time to look into your question in detail, but on line 6, you're building your query with string concatenation. Don't do that, because it's vulnerable to SQL injection. Use parameter substitution instead (see the docs).

[scidam]

Why you didn't use Django ORM for querying the database; Django ORM is designed to be robust to SQL injections.