22 lines
904 B
Python
22 lines
904 B
Python
# 1. The exact query template from routes.py
|
|
sql = "SELECT * FROM users WHERE (BINARY CONCAT(principal, ',', region) = %s)"
|
|
|
|
# 2. The dictionary payload as it exists after unpack() in routes.py
|
|
user_dict = {
|
|
'x" UNION SELECT 1,\'hacker\',\'<hash>\',\'us\',1)-- ': 'irrelevant',
|
|
'token': 'mytoken'
|
|
}
|
|
|
|
# 3. How routes.py passes it to the query_handler: wrapped in a tuple
|
|
# cur = query_handler(sql, cur, (user,))
|
|
params = (user_dict,)
|
|
|
|
print("--- Standard Python % Formatting ---")
|
|
# This is essentially what happens when PyMySQL applies the parameters to the %s placeholder
|
|
formatted_query = sql % params
|
|
print(formatted_query)
|
|
|
|
print("\n--- Why MariaDB Hates It ---")
|
|
print(f"Starts with ODBC bracket: {formatted_query[formatted_query.find('{'):formatted_query.find('{')+1]}")
|
|
print(f"Followed immediately by a quote: {formatted_query[formatted_query.find('{')+1:formatted_query.find('{')+2]}")
|