kill sql injection

kill_sql_inject.py

#/bin/python3
# by d4rk3r

from re import search, sub


def kill_injected_sql(input_string: str) -> str:
    """
    A hard killer for sql injection from an incoming string.

    params:
    input_string : str [the incoming not sure string]
    """

    # keys from an actual sql synthax
    keys_synthax = [
        "CREATE", "DROP", "UPDATE",
        "INSERT", "ALTER", "DELETE",
        "ATTACH", "DETACH"
    ]
    # to manage with lowercase string too
    keys_synthax += list(map(lambda x: x.lower(), keys_synthax))
    # The regex to detect that
    regex = f"^(?=.*SELECT.*FROM)|(?=.*(?:{'|'.join(keys_synthax)})).*$"
    if search(regex, input_string):
        # the patch
        return sub("[^0-9a-zA-Z]+", "_", input_string)

    return input_string

# Some examples
print(kill_injected_sql("SELECT * FROM TESTS"))
print(kill_injected_sql("create TABLE niangua (test not null)"))

# expected outputs
#
# SELECT_FROM_TESTS
# CREATE_TABLE_niangua_test_not_null_