title: How to make the codes different type using Django and Python
body: <p>I need some help. I need to make different for for same code writing as per some condition using Django and Python. I am explaining my code and the scenario below.</p>
  
  <pre><code>if request.method == 'POST':
          location_name = request.POST.get('lname')
          rname = request.POST.get('rname')
          seat = request.POST.get('seat')
          projector = request.POST.get('projector')
          video = request.POST.get('video')
          num=str(random.randint(100000000000,999999999999))
          doc = m.parse("roomlist.xml")
          root=doc.getElementsByTagName("roomlist")
          valeurs = doc.getElementsByTagName("roomlist")[0]
          element = doc.createElement("location")
          element.setAttribute("name"  , location_name)
          el1 = element.appendChild(doc.createElement("room"))
          el1.setAttribute("id", num)
          el2=el1.appendChild(doc.createElement("roomname"))
          el2.appendChild(doc.createTextNode(rname))
          el3=el1.appendChild(doc.createElement("noseats"))
          el3.appendChild(doc.createTextNode(seat))
          el4=el1.appendChild(doc.createElement("projectorscreen"))
          el4.appendChild(doc.createTextNode(projector))
          el5=el1.appendChild(doc.createElement("videoconf"))
          el5.appendChild(doc.createTextNode(video))
          valeurs.appendChild(element)
          doc.writexml(open("roomlist.xml","w"))
      return render(request, 'booking/bmr.html', {})
  </code></pre>
  
  <p>Here this is my form data which are storing into xml format. But I need to serch the data  as per the following condition.</p>
  
  <pre><code>1-Vulnerable code: Application uses SQL Query to search for the room(use sql query to search xml data). The user input (room name) is direct without any validation resulting in injection attack.
  2-Incorrect solution #1: Escape special SQL characters by hand adding a `\` before any special characters
  3-Incorrect solution #2: URL encode paste contents in the request before passing it to the model layer
  4-Incorrect solution #3: Remove special SQL characters
  5-Correct solution: Use prepared statement and pass arguments to it properly
  </code></pre>
  
  <p>My xml file is given below.</p>
  
  <pre><code>&lt;?xml version="1.0" ?&gt;&lt;roomlist&gt;
    &lt;location name="Bangalore"&gt;
      &lt;room id="1uy92j908u092"&gt;
        &lt;roomname&gt; Aquarius &lt;/roomname&gt;
        &lt;noseats&gt; 10 &lt;/noseats&gt;
        &lt;projectorscreen&gt;yes&lt;/projectorscreen&gt;
        &lt;videoconf&gt;yes&lt;/videoconf&gt;
      &lt;/room&gt;
    &lt;/location&gt;
  &lt;location name="Bhubaneswar"&gt;&lt;room id="131198912460"&gt;&lt;roomname&gt;cottage&lt;/roomname&gt;&lt;noseats&gt;5&lt;/noseats&gt;&lt;projectorscreen&gt;Yes&lt;/projectorscreen&gt;&lt;videoconf&gt;Yes&lt;/videoconf&gt;&lt;/room&gt;&lt;/location&gt;&lt;location name="puri"&gt;&lt;room id="509955554930"&gt;&lt;roomname&gt;room1&lt;/roomname&gt;&lt;noseats&gt;10&lt;/noseats&gt;&lt;projectorscreen&gt;No&lt;/projectorscreen&gt;&lt;videoconf&gt;Yes&lt;/videoconf&gt;&lt;/room&gt;&lt;/location&gt;&lt;/roomlist&gt;
  </code></pre>
  
  <p>Here I need to modify the code as per the above condition.Please help me.</p>