"""aman.py — membandingkan query rakit-rakit (rentan) dengan parameterized (aman).

Jalankan dari folder chapter:  python3 aman.py
Port default 3306; timpa lewat variabel lingkungan DB_PORT.
"""

import os

import pymysql

port = int(os.environ.get("DB_PORT", "3306"))
pengaturan = {
    "host": "127.0.0.1",
    "user": "root",
    "password": "",
    "database": "belajar_app",
    "port": port,
}

email_login = "budi@example.com"
payload = "' OR 1=1 -- "

with pymysql.connect(**pengaturan) as koneksi:
    with koneksi.cursor() as kursor:
        sql_rentan = (
            "SELECT id, nama FROM pelanggan WHERE email = '"
            + email_login
            + "'"
        )
        kursor.execute(sql_rentan)
        print("query rentan, email sah      ->", len(kursor.fetchall()), "baris")

        sql_bocor = (
            "SELECT id, nama FROM pelanggan WHERE email = '"
            + payload
            + "'"
        )
        kursor.execute(sql_bocor)
        print("query rentan, payload injeksi ->", len(kursor.fetchall()), "baris")

        sql_aman = "SELECT id, nama FROM pelanggan WHERE email = %s"
        kursor.execute(sql_aman, (payload,))
        print("query parameterized, payload ->", len(kursor.fetchall()), "baris")