# 不安全的代碼
import sqlite3

def get_user(username):
    conn = sqlite3.connect('database.db')
    cursor = conn.cursor()
    # 不安全：直接拼接SQL語句
    cursor.execute(f"SELECT * FROM users WHERE username = '{username}'")
    user = cursor.fetchone()
    conn.close()
    return user

# 攻擊者可以輸入：' OR 1=1 --
# 這會導(dǎo)致執(zhí)行：SELECT * FROM users WHERE username = '' OR 1=1 --'

# 不安全的代碼
from flask import Flask, request, render_template

app = Flask(__name__)

@app.route('/')
def index():
    name = request.args.get('name', 'World')
    # 不安全：直接將用戶輸入插入到HTML中
    return f"<h1>Hello, {name}!</h1>"

# 攻擊者可以輸入：<script>alert('XSS')</script>
# 這會導(dǎo)致在網(wǎng)頁中執(zhí)行JavaScript代碼

# 不安全的代碼
from flask import Flask, request, session

app = Flask(__name__)
app.secret_key = 'secret'

@app.route('/transfer', methods=['POST'])
def transfer():
    # 不安全：沒有驗證請求來源
    amount = request.form.get('amount')
    recipient = request.form.get('recipient')
    # 執(zhí)行轉(zhuǎn)賬操作
    return f"Transferred {amount} to {recipient}"

# 不安全的代碼
import sqlite3

def register_user(username, password):
    conn = sqlite3.connect('database.db')
    cursor = conn.cursor()
    # 不安全：明文存儲密碼
    cursor.execute("INSERT INTO users (username, password) VALUES (?, ?)", (username, password))
    conn.commit()
    conn.close()

# 安全的代碼
import sqlite3

def get_user(username):
    conn = sqlite3.connect('database.db')
    cursor = conn.cursor()
    # 安全：使用參數(shù)化查詢
    cursor.execute("SELECT * FROM users WHERE username = ?", (username,))
    user = cursor.fetchone()
    conn.close()
    return user

# 安全的代碼
from flask import Flask, request, escape

app = Flask(__name__)

@app.route('/')
def index():
    name = request.args.get('name', 'World')
    # 安全：對用戶輸入進行轉(zhuǎn)義
    return f"<h1>Hello, {escape(name)}!</h1>"

# 安全的代碼
from flask import Flask, request, session, render_template
from flask_wtf.csrf import CSRFProtect

app = Flask(__name__)
app.secret_key = 'secret'
csrf = CSRFProtect(app)

@app.route('/transfer', methods=['GET', 'POST'])
def transfer():
    if request.method == 'POST':
        # 安全：CSRF令牌會自動驗證
        amount = request.form.get('amount')
        recipient = request.form.get('recipient')
        # 執(zhí)行轉(zhuǎn)賬操作
        return f"Transferred {amount} to {recipient}"
    return render_template('transfer.html')

# 安全的代碼
import sqlite3
import hashlib
import os

def register_user(username, password):
    conn = sqlite3.connect('database.db')
    cursor = conn.cursor()
    # 安全：使用哈希函數(shù)存儲密碼
    salt = os.urandom(32)
    hashed_password = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), salt, 100000)
    cursor.execute("INSERT INTO users (username, password_hash, salt) VALUES (?, ?, ?)", 
                  (username, hashed_password, salt))
    conn.commit()
    conn.close()

def verify_password(username, password):
    conn = sqlite3.connect('database.db')
    cursor = conn.cursor()
    cursor.execute("SELECT password_hash, salt FROM users WHERE username = ?", (username,))
    result = cursor.fetchone()
    if result:
        password_hash, salt = result
        test_hash = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), salt, 100000)
        return test_hash == password_hash
    return False

# 安裝cryptography
# pip install cryptography

from cryptography.fernet import Fernet

# 生成密鑰
key = Fernet.generate_key()
cipher_suite = Fernet(key)

# 加密數(shù)據(jù)
plaintext = b"Hello, World!"
ciphertext = cipher_suite.encrypt(plaintext)
print(f"Encrypted: {ciphertext}")

# 解密數(shù)據(jù)
decrypted_text = cipher_suite.decrypt(ciphertext)
print(f"Decrypted: {decrypted_text}")

# 安裝pyjwt
# pip install pyjwt

import jwt
import datetime

# 生成token
payload = {
    'user_id': 123,
    'exp': datetime.datetime.utcnow() + datetime.timedelta(hours=1)
}
secret = 'secret_key'
token = jwt.encode(payload, secret, algorithm='HS256')
print(f"Token: {token}")

# 驗證token
try:
    decoded = jwt.decode(token, secret, algorithms=['HS256'])
    print(f"Decoded: {decoded}")
except jwt.ExpiredSignatureError:
    print("Token has expired")
except jwt.InvalidTokenError:
    print("Invalid token")

# 安裝passlib
# pip install passlib

from passlib.hash import pbkdf2_sha256

# 哈希密碼
hashed_password = pbkdf2_sha256.hash('mypassword')
print(f"Hashed password: {hashed_password}")

# 驗證密碼
is_valid = pbkdf2_sha256.verify('mypassword', hashed_password)
print(f"Password is valid: {is_valid}")

# 安裝python-dotenv
# pip install python-dotenv

import os
from dotenv import load_dotenv

# 加載環(huán)境變量
load_dotenv()

# 從環(huán)境變量獲取敏感信息
secret_key = os.getenv('SECRET_KEY')
database_url = os.getenv('DATABASE_URL')

# 使用敏感信息
print(f"Secret key: {secret_key}")
print(f"Database URL: {database_url}")

import os

# 創(chuàng)建文件并設(shè)置權(quán)限
with open('secret.txt', 'w') as f:
    f.write('secret information')

# 設(shè)置文件權(quán)限為600（只有所有者可讀寫）
os.chmod('secret.txt', 0o600)

import ssl
import socket

# 創(chuàng)建安全的SSL連接
context = ssl.create_default_context()
with socket.create_connection(('example.com', 443)) as sock:
    with context.wrap_socket(sock, server_hostname='example.com') as ssock:
        print(f"SSL version: {ssock.version()}")
        print(f"Cipher: {ssock.cipher()}")