Skip to main content
Code Review

Return to Answer

replaced https://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
Source Link

You should never compose URLs using this technique!

search = sys.argv[1]
url = 'https://swapi.co/api/people/?search={0}'.format(search) #need to divide url to make search process more dynamic
r = requests.get(url)

Query string parameters need to be percent-encoded percent-encoded. The Python Requests library provides a correct way to do it:

search = sys.argv[1]
url = 'https://swapi.co/api/people/'
r = requests.get(url, params={'search': search})

Going further, I would caution you to never concatenate any user-supplied string to form another string that will be interpreted by some computer system. You must first considering the escaping mechanism. SQL injections, cross-site scripting, LDAP injection, etc. — they're all vulnerabilities that result from this same kind of carelessness.

You should never compose URLs using this technique!

search = sys.argv[1]
url = 'https://swapi.co/api/people/?search={0}'.format(search) #need to divide url to make search process more dynamic
r = requests.get(url)

Query string parameters need to be percent-encoded. The Python Requests library provides a correct way to do it:

search = sys.argv[1]
url = 'https://swapi.co/api/people/'
r = requests.get(url, params={'search': search})

Going further, I would caution you to never concatenate any user-supplied string to form another string that will be interpreted by some computer system. You must first considering the escaping mechanism. SQL injections, cross-site scripting, LDAP injection, etc. — they're all vulnerabilities that result from this same kind of carelessness.

You should never compose URLs using this technique!

search = sys.argv[1]
url = 'https://swapi.co/api/people/?search={0}'.format(search) #need to divide url to make search process more dynamic
r = requests.get(url)

Query string parameters need to be percent-encoded. The Python Requests library provides a correct way to do it:

search = sys.argv[1]
url = 'https://swapi.co/api/people/'
r = requests.get(url, params={'search': search})

Going further, I would caution you to never concatenate any user-supplied string to form another string that will be interpreted by some computer system. You must first considering the escaping mechanism. SQL injections, cross-site scripting, LDAP injection, etc. — they're all vulnerabilities that result from this same kind of carelessness.

Source Link
200_success
  • 145.5k
  • 22
  • 190
  • 478

You should never compose URLs using this technique!

search = sys.argv[1]
url = 'https://swapi.co/api/people/?search={0}'.format(search) #need to divide url to make search process more dynamic
r = requests.get(url)

Query string parameters need to be percent-encoded. The Python Requests library provides a correct way to do it:

search = sys.argv[1]
url = 'https://swapi.co/api/people/'
r = requests.get(url, params={'search': search})

Going further, I would caution you to never concatenate any user-supplied string to form another string that will be interpreted by some computer system. You must first considering the escaping mechanism. SQL injections, cross-site scripting, LDAP injection, etc. — they're all vulnerabilities that result from this same kind of carelessness.

lang-py

AltStyle によって変換されたページ (->オリジナル) /