Patched test_sql_injection.py

test_sql_injection.py

@@ -0,0 +1,28 @@
+import asyncio
+from sqli.dao.student import Student
+import aiopg
+
+async def test_sql_injection():
+    # Try potential SQL injection attacks
+    dsn = 'dbname=students user=postgres password=postgres host=localhost'
+
+    try:
+        async with aiopg.create_pool(dsn) as pool:
+            async with pool.acquire() as conn:
+                # Test 1: Try SQL injection in name parameter
+                malicious_name = "Robert'); DROP TABLE students; --"
+                await Student.create(conn, malicious_name)
+
+                # Test 2: Try to fetch the injected record
+                students = await Student.get_many(conn)
+                print("Retrieved students:", students)
+
+                # Test 3: Try SQL injection in id parameter
+                student = await Student.get(conn, "1 OR 1=1")
+                print("Get student result:", student)
+
+    except Exception as e:
+        print(f"Error occurred: {e}")
+
+if __name__ == "__main__":
+    asyncio.run(test_sql_injection())