from flask import Flask, render_template, request, redirect, url_for
from flask_mysqldb import MySQL
app = Flask(__name__)
# MySQL configurations
app.config['MYSQL_HOST'] = 'localhost'
app.config['MYSQL_USER'] = 'ayra'
app.config['MYSQL_PASSWORD'] = 'yourpassword' # replace with your actual password
app.config['MYSQL_DB'] = 'hackerpoulette'
mysql = MySQL(app)
@app.route('/')
def welcome():
return render_template('hello.html')
@app.route('/login', methods=['GET', 'POST'])
def login():
if request.method == 'POST':
# Get form data
username = request.form['username']
last_name = request.form['lastName']
email = request.form['email']
country = request.form['country']
gender = request.form['gender']
services = request.form.getlist('service') # Get list of selected services
services_str = ','.join(services) # Join the list into a string
# Insert form data into the database
cur = mysql.connection.cursor()
cur.execute("INSERT INTO users(first_name, last_name, email, country, gender, service) VALUES (%s, %s, %s, %s, %s, %s)",
(username, last_name, email, country, gender, services_str))
mysql.connection.commit()
cur.close()
return redirect(url_for('welcome'))
return render_template('login.html')
if __name__ == '__main__':
app.run(debug=True)
CREATE TABLE users (
id INT AUTO_INCREMENT PRIMARY KEY,
first_name VARCHAR(50),
last_name VARCHAR(50),
email VARCHAR(100),
country VARCHAR(50),
gender VARCHAR(10),
service VARCHAR(255)
);
Verify the database is correctly connected :
SELECT * from USERS;
Sanitizing form input
Sanitizing form on client side :
Bleach is a python library which handle input and sanitize them before it's sent to the backend.
pip install bleach
Implementation of bleach in our router :
from flask import Flask, render_template, request, redirect, url_for
from flask_mysqldb import MySQL
import bleach
app = Flask(__name__)
# MySQL configurations
app.config['MYSQL_HOST'] = 'localhost'
app.config['MYSQL_USER'] = 'ayra'
app.config['MYSQL_PASSWORD'] = 'passwordhere' # replace with your actual password
app.config['MYSQL_DB'] = 'hackerpoulette'
mysql = MySQL(app)
@app.route('/')
def welcome():
return render_template('hello.html')
@app.route('/success')
def success():
return render_template('success.html')
@app.route('/login', methods=['GET', 'POST'])
def login():
if request.method == 'POST':
# Get form data
username = bleach.clean(request.form['username']) # Sanitize username
last_name = bleach.clean(request.form['lastName']) # Sanitize last name
email = bleach.clean(request.form['email']) # Sanitize email
country = bleach.clean(request.form['country']) # Sanitize country
gender = request.form['gender'] # Gender doesn't need sanitization
services = request.form.getlist('service') # Get list of selected services
services_str = ','.join(services) # Join the list into a string
# Insert form data into the database
cur = mysql.connection.cursor()
cur.execute("INSERT INTO users(first_name, last_name, email, country, gender, service) VALUES (%s, %s, %s, %s, %s, %s)",
(username, last_name, email, country, gender, services_str))
mysql.connection.commit()
cur.close()
return redirect(url_for('success'))
return render_template('login.html')
if __name__ == '__main__':
app.run(debug=True)
Prevent SQL injection by sanitizing server-side input data :
Instead of directly concatenating user inputs into SQL queries, parameterized queries use placeholders (%s in this case) to separate SQL code from user-supplied data. This method ensures that user inputs are treated as data rather than executable SQL code, thus preventing SQL injection attacks.
The MySQL library I'm using (pymysqld) automatically handles escaping special characters in the parameters passed through %s.
This means that even if a user enters something like ' OR '1'='1', it will be safely treated as data rather than an attempt to modify the query structure.
