网站安全测试创建

import requests

def check_sql_injection(url):
    payload = "' OR '1'='1"
    response = requests.get(f"{url}?id={payload}")
    if "Welcome back" in response.text:
        print("Potential SQL Injection vulnerability found!")

check_sql_injection("http://example.com/user")

function escapeHtml(unsafe) {
    return unsafe
         .replace(/&/g, "&")
         .replace(/</g, "&lt;")
         .replace(/>/g, "&gt;")
         .replace(/"/g, "&quot;")
         .replace(/'/g, "&#039;");
}

const userInput = "<script>alert('XSS')</script>";
const safeInput = escapeHtml(userInput);
document.getElementById("output").innerHTML = safeInput;

from flask import Flask, request, abort

app = Flask(__name__)

@app.route('/user/<int:user_id>')
def get_user(user_id):
    if not is_authorized(user_id):
        abort(403)
    return f"User {user_id} details"

def is_authorized(user_id):
    # 实现权限检查逻辑
    return True  # 示例中简化处理

if __name__ == '__main__':
    app.run(debug=True)