Flask请求上下文外操作报错：RuntimeError问题修复求助

问题场景 #

在VSCode中运行Python脚本，目标是从MySQL提取数据并传递到HTML页面展示，但执行时触发如下错误：

Traceback (most recent call last):
  File "C:\Users\chuan\OneDrive\Desktop\custom_header_pra_1.12\test_showing_content_middle\get_sql_where_02.py", line 22, in <module>
    mycursor.execute("SELECT P_TITLE,P_DESC  FROM webpage WHERE P_ID = "+request.args["ProductID"])
  File "C:\Users\chuan\AppData\Local\Programs\Python\Python310\lib\site-packages\werkzeug\local.py", line 316, in __get__ 
    obj = instance._get_current_object()  # type: ignore[misc]
  File "C:\Users\chuan\AppData\Local\Programs\Python\Python310\lib\site-packages\werkzeug\local.py", line 513, in _get_current_object
    raise RuntimeError(unbound_message) from None
RuntimeError: Working outside of request context.

This typically means that you attempted to use functionality that needed
an active HTTP request. Consult the documentation on testing for
information about how to avoid this problem.

原Python脚本get_sql_where_02.py：

# get_sql_where_02.py

import mysql.connector
import webbrowser
import time
import pymysql
from flask import Flask,render_template,request 

app = Flask(__name__)

mydb = mysql.connector.connect(
  host="196.168.1.141",
  user="Main_root",
  password="password_123", 
  database="database_db",  
  auth_plugin='mysql_native_password'
)
              
mycursor = mydb.cursor()
# mycursor.execute("SELECT P_TITLE,P_DESC  FROM webpage WHERE P_ID = 'en_1-01'")  
mycursor.execute("SELECT P_TITLE,P_DESC  FROM webpage WHERE P_ID = "+request.args["ProductID"])
                      
myresult = mycursor.fetchall()

print(myresult)    # does get the result I want 

@app.route('/')
def index():
    return render_template("index_test_0203.html", myresult = myresult)

if __name__ == "__main__":
    app.run(debug=True)

原HTML页面index_test_0203.html：

<!DOCTYPE html>
<html>
    <body>
      <p> this is {{myresult}}</p>

    </body>
</html>

错误原因 #

1. request对象使用时机错误：request.args["ProductID"]被放在Flask路由处理函数外部，脚本初始化阶段就执行了这行代码，此时无HTTP请求进入，不存在请求上下文，触发报错。
2. 数据库查询逻辑位置错误：查询逻辑在全局作用域，仅脚本启动时执行一次，无法响应每次请求的参数变化。
3. SQL注入风险：直接拼接SQL字符串，若参数被恶意构造，会导致SQL注入攻击。

修正后的代码 #

Python脚本（get_sql_where_02.py） #

# get_sql_where_02.py

import mysql.connector
from flask import Flask, render_template, request 

app = Flask(__name__)

@app.route('/')
def index():
    # 获取请求参数，处理参数缺失情况
    product_id = request.args.get("ProductID")
    if not product_id:
        return "ProductID参数缺失", 400
    
    # 在请求上下文内建立数据库连接并执行查询
    mydb = mysql.connector.connect(
        host="196.168.1.141",
        user="Main_root",
        password="password_123", 
        database="database_db",  
        auth_plugin='mysql_native_password'
    )
    mycursor = mydb.cursor()
    
    # 参数化查询避免SQL注入
    sql = "SELECT P_TITLE,P_DESC FROM webpage WHERE P_ID = %s"
    mycursor.execute(sql, (product_id,))
    myresult = mycursor.fetchall()
    
    # 关闭游标与连接
    mycursor.close()
    mydb.close()
    
    return render_template("index_test_0203.html", myresult=myresult)

if __name__ == "__main__":
    app.run(debug=True)

HTML页面（index_test_0203.html，优化展示） #

<!DOCTYPE html>
<html>
    <body>
        {% if myresult %}
            {% for item in myresult %}
                <h3>{{ item[0] }}</h3>
                <p>{{ item[1] }}</p>
            {% endfor %}
        {% else %}
            <p>未查询到相关数据</p>
        {% endif %}
    </body>
</html>

关键说明 #

• 请求上下文内使用request：所有依赖HTTP请求的操作（如获取request.args）必须放在@app.route修饰的函数内部，此时请求上下文已激活。
• 参数化查询：用%s作为占位符，通过元组传递参数，彻底规避SQL注入风险。
• 数据库连接管理：在请求处理函数内创建和关闭连接，确保每次请求使用独立连接（复杂场景可改用连接池）。
• 参数校验：添加参数存在性校验，避免因参数缺失引发后续错误。

内容的提问来源于stack exchange，提问作者俠客行_da code learner