Lesson 6 of 20 · 50 min · UG / professional
pickle, XML and binary records
pickle saves a Python object — do not unpickle a stranger’s file. XML is nested labelled text. struct packs bytes for a vendor device. JSON+UTF-8 is still the default for campus APIs.
Persistent store
Files and tables remember after the program stops.
You will be able to
- ✓ Refuse to unpickle a stranger’s file
- ✓ See XML as nested labelled text, not a second Python
- ✓ Keep struct/binary for vendor devices; JSON+UTF-8 for campus APIs
pickle saves a Python object — that is the danger
pickle can dump a dict of DHT readings and load it later. It can also run code hidden in a file someone forwarded on WhatsApp. Never pickle.load a stranger’s attachment. Campus APIs should speak JSON and UTF-8. pickle is a private cache between two processes you control.
This sandbox has no pickle. A trusted flag is the analog: if trusted is 0, print Reject and do not ‘load’.
XML is nested labels
A vendor attendance panel might still emit XML. Nested tags map to nested dicts in your head: lab, then dht, then c. You parse with the stdlib on a laptop. You do not invent a second grammar in a notebook cell.
struct packs bytes for a device
A USB bench meter may want two unsigned shorts, big-endian. struct.pack is that contract. A kiosk JSON body is not. Mixing them is how a heat reading becomes punctuation.
Words that matter
- pickle
- Python-to-bytes for objects you trust — not for strangers.
- XML
- Nested labelled text — vendor panels, not new campus APIs.
- struct
- Pack/unpack binary records for a device contract.
Common mistakes
Avoid: Unpickling a file from email because it ‘looked like’ a dict.
Do this: JSON+UTF-8 for campus APIs; pickle only for a private cache you wrote.
Run it step by step
Each box is a real program. Press Run, change a number, Run again — the output must follow your code.
1. Step 1 — refuse an untrusted blob
trusted 0 is the analog of ‘do not pickle.load’.
Edit the example, press Run, then Build if you want a compile check.
build
Press Build to compile.
2. Step 2 — nested labels as a dict
XML-shaped. JSON-shaped. Same keys you would read after a parse.
Edit the example, press Run, then Build if you want a compile check.
build
Press Build to compile.
On a full Python install — pickle, xml.etree, struct
Private cache vs WhatsApp danger; vendor XML; packed volts/amps for a meter. JSON remains the campus default.
No pip — stdlib.
Only unpickle files you wrote. XML and struct at the device edge.
Real library code (not run in this browser sandbox)
import pickle
import struct
import xml.etree.ElementTree as ET
# NEVER pickle.load a WhatsApp attachment
reading = {"id": "DHT-04", "c": 31}
def save_trusted(path, row):
with open(path, "wb") as f:
pickle.dump(row, f)
xml_text = "<lab><dht id='04'><c>31</c></dht></lab>"
root = ET.fromstring(xml_text)
packed = struct.pack(">HH", 12, 2)
print(root.find("dht").get("id"), len(packed))
Example program — Binary analog is still labelled fields
A meter wants volts and amps. You keep names until the USB edge.
Edit the example, press Run, then Build if you want a compile check.
build
Press Build to compile.
Your turn — Trusted gate
If trusted is 0, print Reject. Use trusted = 0.
Edit the example, press Run, then Build if you want a compile check.
build
Press Build to compile.
Self-assessment
Check your understanding before you mark the lesson complete.
Progress is stored in a browser cookie on this device.