用Python简单处理SQL语句绕过防注入

1,

#!/usr/bin/python
# -*- coding: utf-8 -*-

def sqlencode(sql,do):
    if(do == "+"):
        sqlend = sql.replace(" ","+")#"+".join(sql)
    elif(do == "*"):
        sqlend = sql.replace(" ","/**/")#"/**/".join(sql)
    elif(do == "%09"):
        sqlend = sql.replace(" ","%09")#"%09".join(sql)
    else:
        print "you got a wrong choice!"
    return sqlend
co = "Code Made By Hackfreer version 1"
useage = "Encode method:+,*,%09"
print co.center(50)
print useage.center(50)
tipLine1 = raw_input("Please enter your sql str:")
tipLine2 = raw_input("Please enter your encode methods:")
print sqlencode(str1,str2)

可以实现空格的几种转化

2,

#!/usr/bin/python
# -*- coding= utf-8 -*-

import string

def encodeSql(str):
        result = ""
        for i in range(0,len(str)):
                temp = str[i]
                if(i % 2 == 0):
                        sqlTemp = temp.upper()
                        result += sqlTemp
                else:
                        result += temp
                i += 1
               
        return result
       
str = raw_input("Please input your sqlcode:")
print encodeSql(str)

可以实现对SQL语句的随机大小写转换