小林的程式會不會遇到 SQL Injection

sql_str = "SELECT * FROM users WHERE (name = '" + username + "') and (pw = '"+ password +"');"

username = "1' OR '1'='1"
password = "1' OR '1'='1"

SELECT * FROM users WHERE (name = '1' OR '1'='1') and (pw = '1' OR '1'='1');

poetry add web.py==0.39

Creating virtualenv kobayashi-pwI4Cysh-py3.8 in /Users/weilee/Library/Caches/pypoetry/virtualenvs

Updating dependencies
Resolving dependencies... (0.1s)

Writing lock file


Package operations: 1 install, 0 updates, 0 removals

  - Installing web.py (0.39)

[EnvCommandError]
Command ['/Users/weilee/Library/Caches/pypoetry/virtualenvs/kobayashi-pwI4Cysh-py3.8/bin/pip', 'install', '--no-deps', 'web.py==0.39'] errored with the following return code 1, and output:
Collecting web.py==0.39
  Using cached web.py-0.39.tar.gz (93 kB)
    ERROR: Command errored out with exit status 1:
     command: /Users/weilee/Library/Caches/pypoetry/virtualenvs/kobayashi-pwI4Cysh-py3.8/bin/python -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'/.../web.py/setup.py'"'"'; __file__='"'"'/.../web.py/setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' egg_info --egg-base /...
         cwd: /.../web.py/
    Complete output (7 lines):
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "/.../web.py/setup.py", line 6, in <module>
        from web import __version__
      File "/.../web.py/web/__init__.py", line 14, in <module>
        import utils, db, net, wsgi, http, webapi, httpserver, debugerror
    ModuleNotFoundError: No module named 'utils'
    ----------------------------------------
ERROR: Command errored out with exit status 1: python setup.py egg_info Check the logs for full command output.
WARNING: You are using pip version 20.1.1; however, version 20.2.3 is available.
You should consider upgrading via the '/Users/weilee/Library/Caches/pypoetry/virtualenvs/kobayashi-pwI4Cysh-py3.8/bin/python -m pip install --upgrade pip' command.

import sqlite3


def init_db():
    # connect and create "kobayashi.db"
    conn = sqlite3.connect("kobayashi.db")

    # create USER table
    create_table_sql = """
    CREATE TABLE `USER` (
        `account`   TEXT NOT NULL UNIQUE,
        `password`  TEXT NOT NULL,
        PRIMARY KEY(`account`)
    );
    """

    # insert users into USER table
    insert_user_sql = """
    INSERT INTO
        USER (account, password)
    VALUES
        ('kobayashi', '1'),
        ('tohru', '2'),
        ('kanna', '3'),
        ('elma', '3');
    """

    conn.execute(create_table_sql)
    conn.execute(insert_user_sql)
    conn.commit()
    conn.close()


if __name__ == "__main__":
    init_db()

from typing import Optional, Tuple

import web


def login(account: str, password: str) -> Optional[web.utils.Storage]:
    result_set = db.select(
        "USER", where=f"account ='{account}' AND password='{password}'"
    )
    user = result_set.first()
    if user:
        print("login succeeded")
        return user
    else:
        print("wrong username or password")
        return None

if __name__ == "__main__":
    db = web.database(dbn="sqlite", db="kobayashi.db")

    print(login("kobayashi", ""))
    print(login("kobayashi", "1"))
    print(login("1' OR '1'='1", "1' OR '1'='1"))

0.0 (1): SELECT * FROM USER WHERE account ='kobayashi' AND password=''
wrong username or password
None

0.0 (2): SELECT * FROM USER WHERE account ='kobayashi' AND password='1'
login succeeded
<Storage {'account': 'kobayashi', 'password': '1'}>

0.0 (3): SELECT * FROM USER WHERE account ='1' OR '1'='1' AND password='1' OR '1'='1'
login succeeded
<Storage {'account': 'kobayashi', 'password': '1'}>

def login(account: str, password: str) -> Optional[web.utils.Storage]:
    result_set = db.select(
        "USER",
        where=f"account=$account AND password=$password",
        vars={"account": account, "password": password},
    )
    user = result_set.first()
    if user:
        print("login succeeded")
        return user
    else:
        print("wrong username or password")
        return None

0.0 (3): SELECT * FROM USER WHERE account ="1' OR '1'='1" AND password="1' OR '1'='1"
wrong username or password
None

(Pdb++) p clauses
[<sql: 'SELECT *'>, <sql: 'FROM USER'>, <sql: 'WHERE account ="1\' OR \'1\'=\'1" AND password="1\' OR \'1\'=\'1"'>]

(Pdb++) p sql
'WHERE'

(Pdb++) p val
'account =$account AND password=$password'

(Pdb++) p vars
{'account': "1' OR '1'='1", 'password': "1' OR '1'='1"}

(Pdb++) p list(nodes)
[Node('text', 'account =', None), Node('param', 'account', None), Node('text', ' AND password=', None), Node('param', 'password', None)]

['account =', <sql: '"1\' OR \'1\'=\'1"'>, ' AND password=', <sql: '"1\' OR \'1\'=\'1"'>]

(Pdb++) p target
<sql: 'account ="1\' OR \'1\'=\'1" AND password="1\' OR \'1\'=\'1"'>

(Pdb++) p target.items
['account =', <param: "1' OR '1'='1">, ' AND password=', <param: "1' OR '1'='1">]

(Pdb++) p target.values()
["1' OR '1'='1", "1' OR '1'='1"]

(Pdb++) p target.query()
'account =%s AND password=%s'

(Pdb++) p qout
<sql: 'SELECT * FROM USER WHERE account ="1\' OR \'1\'=\'1" AND password="1\' OR \'1\'=\'1"'>

DELETE FROM USER WHERE account = '' OR ''=''