libinjection

package module
v0.3.3 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 1, 2026 License: BSD-3-Clause Imports: 3 Imported by: 8

README

libinjection

License codecov CodeQL

libinjection is a Go porting of the libinjection(http://www.client9.com/projects/libinjection/) and it's thread safe.

How to use

SQLi Example
package main

import (
    "fmt"
    "github.com/corazawaf/libinjection-go"
)

func main() {
    result, fingerprint := libinjection.IsSQLi("-1' and 1=1 union/* foo */select load_file('/etc/passwd')--")
    fmt.Println("=========result==========: ", result)
    fmt.Println("=======fingerprint=======: ", string(fingerprint))
}
XSS Example
package main

import (
	"fmt"
	"github.com/corazawaf/libinjection-go"
)

func main() {
	fmt.Println("result: ", libinjection.IsXSS("<script>alert('1')</script>"))
}

License

libinjection-go is distributed under the same license as the libinjection.

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func IsSQLi

func IsSQLi(input string) (bool, string)

IsSQLi returns true if the input is SQLi. It also returns the fingerprint of the SQL injection as a string.

func IsXSS

func IsXSS(input string) bool

IsXSS returns true if the input string contains XSS.

Five HTML5 parse contexts are tried. The DataState context requires '<' to produce any tag tokens, so it is skipped when '<' is absent — saving one full state-machine pass for the common case of clean input. The four attribute-value contexts can detect injection without '<' (e.g. onerror=...) and always run.

Types

This section is empty.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL