代码安全审查双十二促销活动

# 使用参数化查询防止SQL注入
import sqlite3

def get_user(username):
    conn = sqlite3.connect('example.db')
    cursor = conn.cursor()
    cursor.execute("SELECT * FROM users WHERE username = ?", (username,))
    user = cursor.fetchone()
    conn.close()
    return user

// 使用转义函数防止XSS攻击
function escapeHtml(unsafe) {
    return unsafe
         .replace(/&/g, "&")
         .replace(/</g, "&lt;")
         .replace(/>/g, "&gt;")
         .replace(/"/g, "&quot;")
         .replace(/'/g, "&#039;");
}

document.getElementById("user-input").innerHTML = escapeHtml(userInput);

# 使用装饰器进行权限检查
from functools import wraps
from flask import Flask, request, abort

app = Flask(__name__)

def require_auth(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        auth = request.authorization
        if not auth or not check_auth(auth.username, auth.password):
            abort(401)
        return f(*args, **kwargs)
    return decorated

@app.route('/protected')
@require_auth
def protected():
    return "You are authorized!"