Python sql注入 過濾字符串的非法字符

#coding:utf8
#在開發過程中，要對前端傳過來的數據進行驗證，防止sql注入攻擊，其中的一個方案就是過濾用戶傳過來的非法的字符


def sql_filter(sql, max_length=20):
    dirty_stuff = ["\"", "\\", "/", "*", "'", "=", "-", "#", ";", "<", ">", "+", "%", "$", "(", ")", "%", "@","!"]
    for stuff in dirty_stuff:
        sql = sql.replace(stuff, "")
    return sql[:max_length]


username = "1234567890!@#!@#!@#$%======$%"

username = sql_filter(username)  # SQL注入
print username

# 輸出結果是:1234567890