从搜索词中过滤表

function filterTableName(input) {
    const forbiddenWords = ['users', 'admin', 'database']; // 示例黑名单
    const regex = new RegExp(forbiddenWords.join('|'), 'i');
    return input.replace(regex, '');
}

const userInput = document.getElementById('searchInput').value;
const safeInput = filterTableName(userInput);

import re
from flask import Flask, request
from sqlalchemy import create_engine, text

app = Flask(__name__)
engine = create_engine('sqlite:///example.db')

@app.route('/search', methods=['GET'])
def search():
    user_input = request.args.get('query')
    
    # 过滤非法表名
    forbidden_words = ['users', 'admin', 'database']
    regex = re.compile('|'.join(forbidden_words), re.IGNORECASE)
    safe_input = regex.sub('', user_input)
    
    with engine.connect() as conn:
        result = conn.execute(text(f"SELECT * FROM safe_table WHERE column LIKE :input"), {"input": f"%{safe_input}%"})
        return {'results': [row for row in result]}

if __name__ == '__main__':
    app.run(debug=True)