sql.py

from flask import Flask, request, jsonify
import mysql.connector  # Import the MySQL Connector module

app = Flask(__name__)

# MySQL Database Configuration
db_config = {
    'host': 'localhost',
    'user': 'root',
    'password': 'Password',
    'database': 'data2',
}

# Database Connection
connection = mysql.connector.connect(**db_config)

# Function to check for SQL injection
def is_sql_injection(value):
    # List of common SQL keywords
    sql_keywords = ['SELECT', 'INSERT', 'UPDATE', 'DELETE', 'FROM', 'WHERE', 'AND', 'OR']

    # Check if the value contains any SQL keywords
    return any(keyword in value.upper() for keyword in sql_keywords)

# Routes for CRUD operations

@app.route('/add_user', methods=['POST'])
def add_user():
    try:
        data = request.json
        username = data['username']
        admin = data['admin']

        # Check for SQL injection in the input
        if is_sql_injection(username) or is_sql_injection(str(admin)):
            return jsonify({'error': 'Potential SQL injection detected'})

        cursor = connection.cursor()

        # Use parameterized query to prevent SQL injection
        query = "INSERT INTO users3 (username, admin) VALUES (%s, %s)"
        values = (username, admin)
        
        cursor.execute(query, values)
        connection.commit()

        return jsonify({'message': 'User added successfully'})
    except Exception as e:
        return jsonify({'error': str(e)})

@app.route('/get_users', methods=['GET'])
def get_users():
    cursor = connection.cursor()
    cursor.execute("SELECT * FROM users3")
    result = cursor.fetchall()

    users = [{'id': row[0], 'username': row[1], 'admin': row[2]} for row in result]
    return jsonify({'users': users})

# Add more routes for updating and deleting users as needed

if __name__ == '__main__':
    app.run(debug=True)