Bleach is a python library which handle input and sanitize them before it's sent to the backend.
pip install bleach
Implementation of bleach in our router :
Prevent SQL injection by sanitizing server-side input data :
Instead of directly concatenating user inputs into SQL queries, parameterized queries use placeholders (%s in this case) to separate SQL code from user-supplied data. This method ensures that user inputs are treated as data rather than executable SQL code, thus preventing SQL injection attacks.
The MySQL library I'm using (pymysqld) automatically handles escaping special characters in the parameters passed through %s.
This means that even if a user enters something like ' OR '1'='1', it will be safely treated as data rather than an attempt to modify the query structure.
from flask import Flask, render_template, request, redirect, url_for
from flask_mysqldb import MySQL
app = Flask(__name__)
# MySQL configurations
app.config['MYSQL_HOST'] = 'localhost'
app.config['MYSQL_USER'] = 'ayra'
app.config['MYSQL_PASSWORD'] = 'yourpassword' # replace with your actual password
app.config['MYSQL_DB'] = 'hackerpoulette'
mysql = MySQL(app)
@app.route('/')
def welcome():
return render_template('hello.html')
@app.route('/login', methods=['GET', 'POST'])
def login():
if request.method == 'POST':
# Get form data
username = request.form['username']
last_name = request.form['lastName']
email = request.form['email']
country = request.form['country']
gender = request.form['gender']
services = request.form.getlist('service') # Get list of selected services
services_str = ','.join(services) # Join the list into a string
# Insert form data into the database
cur = mysql.connection.cursor()
cur.execute("INSERT INTO users(first_name, last_name, email, country, gender, service) VALUES (%s, %s, %s, %s, %s, %s)",
(username, last_name, email, country, gender, services_str))
mysql.connection.commit()
cur.close()
return redirect(url_for('welcome'))
return render_template('login.html')
if __name__ == '__main__':
app.run(debug=True)
