""" --- 数据库 --- """
SQL_CONFIG = {
    "host":"localhost",
    "user":"root",
    "passwd":"root",
    "port":3306,
    "charset":"utf8"
}
SQL_DATABASE = "hg"
SQL_TABLE_PRE = ""
SQL_TABLES={
    "adminLogin" : SQL_TABLE_PRE + "userinfo",
}

import pymysql


class SQLConnect(object):
    """
        Todo: SQLConnect
        ---
        @host -> str `default:localhost`
        @user -> str `default:root`
        @passwd -> str `default:`
        @port -> int `default:3306`
        @charset -> str `default:utf8`
        ---

        @Return ||Dict||
        @

    """

    defaultDict = {
        "host": "localhost",
        "user": "root",
        "passwd": "",
        "port": 3306,
        "charset": "utf8"
    }

    db = None
    point = None
    isConnect = False

    def __init__(self, **interfaces):
        if interfaces is not None:
            for k, v in interfaces.items():
                self.defaultDict[k] = v if self.defaultDict[k] != v else self.defaultDict[k]

    def connect(self) -> bool:
        """连接数据库"""
        try:
            self.db = pymysql.connect(host=self.defaultDict["host"], user=self.defaultDict["user"],
                                      password=self.defaultDict["passwd"], charset=self.defaultDict["charset"],
                                      port=self.defaultDict["port"])
            self.point = self.db.cursor()
            self.isConnect = True
        except:
            return False
        return True

    def disconnect(self) -> bool:
        """关闭数据库连接"""
        if self.isConnect:
            try:
                self.db.close()
                self.point.close()
                self.isConnect = False
            except:
                return False
            return True
        else:
            return False

    @staticmethod
    def __insertColumnFormat(keys: list) -> str:
        return "(`" + "`,`".join(keys) + "`)"

    @staticmethod
    def __insertValueFormat(values: list) -> str:
        return "(" + ",".join(['%s' for i in range(len(values))]) + ")"

    @staticmethod
    def __queryColumn(keys:list) -> str:
        return "`" + "`,`".join(keys) + "`"

    @staticmethod
    def __queryForm(keys: list, pad: str = "AND") -> str:
        return f" {pad} ".join([f"`{each}` = %s" for each in keys])

    @staticmethod
    def __queryFormInject(data: dict, pad: str = "AND") -> str:
        return f" {pad} ".join([f"`{key}` = '{value}'" for key,value in data.items()])

    """
        Function: select_db
        ---
        @name -> str `default:`
        ---
        
        @Return ||Bool||
    """
    def select_db(self, name: str) -> bool:
        """选择数据库"""
        if self.isConnect:
            self.db.select_db(name)
            return True
        else:
            return False

    """
        Function: query
        ---
        @table -> str `default:`
        @columns -> list `default:`
        @conditions -> dict `default:`
        @extraString -> str `default:`
        ---
        
        @Return ||Tuple||
        @
    """
    def query(self,table: str,columns:list,conditions:dict,extraString:str,pad:str="AND") -> dict:
        """数据查询"""
        if self.isConnect:
            col = self.__queryColumn(columns) if len(columns) > 0 else "*"
            q = f"SELECT {col} FROM `{table}`" + " WHERE " + self.__queryForm(list(conditions.keys()),pad = pad) + extraString if len(conditions) > 0 else f"SELECT {col} FROM `{table}`" + extraString
            self.point.execute(query = q,args=tuple(conditions.values()))
            self.db.commit()
            return self.point.fetchall()
        else:
            return {}

    """
            Function: queryInject
            ---
            @table -> str `default:`
            @columns -> list `default:`
            @conditions -> dict `default:`
            @extraString -> str `default:`
            ---

            @Return ||Tuple||
            @
        """

    def queryInject(self, table: str, columns: list, conditions: dict, extraString: str, pad: str = "AND") -> dict:
        """数据查询"""
        if self.isConnect:
            col = self.__queryColumn(columns) if len(columns) > 0 else "*"
            q = f"SELECT {col} FROM `{table}`" + " WHERE " + self.__queryFormInject(conditions,pad=pad) + extraString if len(conditions) > 0 else f"SELECT {col} FROM `{table}`" + extraString
            self.point.execute(query=q)
            self.db.commit()
            return self.point.fetchall()
        else:
            return {}

    """
        Function: update
        ---
        @table -> str `default:`
        @update -> dict `default:`
        @condition -> dict `default:`
        @extraString -> str `default:`
        ---

        @Return ||Int||
        @
    """
    def update(self,table:str, update:dict,conditions:dict,extraString:str,pad:str="AND") -> int:
        """数据更新"""
        if self.isConnect:
            q = f"UPDATE `{table}` SET " + self.__queryForm(list(update.keys()),pad = ",") + " WHERE " + self.__queryForm(list(conditions.keys()),pad = pad) + extraString if len(conditions) > 0 else f"UPDATE `{table}` SET " + self.__queryForm(list(update.keys()),pad = ",") + extraString
            r = self.point.execute(query = q,args = tuple(list(update.values()) + list(conditions.values())))
            self.db.commit()
            return r
        else:
            return -1
        

# 先判断用户名/邮箱是否正确
SELECT * FROM `userinfo` WHERE `userName` = '[用户名]' OR `userEmail` = '[邮箱]'
# 若能选择得到，则再判断选择到的密码hash和输入的密码的hash是否一致

# 比如当形如substr被过滤时可以用left+right构成逐个字符盲注猜解
123'^if((select(right((left(lpad(bin(ord(right((left(user(),1)),1))),7,'0'),1)),1))),sleep(1),1)#

SELECT * FROM `userinfo` WHERE (`userName` = '123'^if((select(right((left(lpad(bin(ord(right((left(user(),1)),1))),7,'0'),1)),1))),sleep(1),1)#' OR `userEmail` = '[邮箱]')

 @staticmethod
   def __queryForm(keys: list, pad: str = "AND") -> str:
       return f" {pad} ".join([f"`{each}` = %s" for each in keys])
@staticmethod
   def __queryColumn(keys:list) -> str:
       return "`" + "`,`".join(keys) + "`"
def query(self,table: str,columns:list,conditions:dict,extraString:str,pad:str="AND") -> dict:
       """数据查询"""
       if self.isConnect:
           col = self.__queryColumn(columns) if len(columns) > 0 else "*"
           q = f"SELECT {col} FROM `{table}`" + " WHERE " + self.__queryForm(list(conditions.keys()),pad = pad) + extraString if len(conditions) > 0 else f"SELECT {col} FROM `{table}`" + extraString
           print(q)
           self.point.execute(query = q,args=tuple(conditions.values()))
           self.db.commit()
           return self.point.fetchall()
       else:
           return {}

self.point.execute(query = q,args=tuple(conditions.values()))
self.db.commit()

   @staticmethod
   def __queryFormInject(data: dict, pad: str = "AND") -> str:
       return f" {pad} ".join([f"`{key}` = '{value}'" for key,value in data.items()])
@staticmethod
   def __queryColumn(keys:list) -> str:
       return "`" + "`,`".join(keys) + "`"
   def queryInject(self, table: str, columns: list, conditions: dict, extraString: str, pad: str = "AND") -> dict:
       """数据查询"""
       if self.isConnect:
           col = self.__queryColumn(columns) if len(columns) > 0 else "*"
           q = f"SELECT {col} FROM `{table}`" + " WHERE " + self.__queryFormInject(conditions,pad=pad) + extraString if len(conditions) > 0 else f"SELECT {col} FROM `{table}`" + extraString
           self.point.execute(query=q)
           self.db.commit()
           return self.point.fetchall()
       else:
           return {}

func sqlColConnect(col []string) (result string) {

	if len(col) == 1 && col[0] == "*" {
		return "*"
	}
	for k, s := range col {
		col[k] = "`" + s + "`"
	}
	result = strings.Join(col, ",")
	return
}
func sqlConditionConnectInject(condition map[string]interface{}, pad string) (result string) {

	conStr := make([]string, 0, len(condition))
	if pad == "" {
		pad = " AND "
	}
	for k, v := range condition {
		conStr = append(conStr, k+" = '"+v.(string)+"'")
	}
	result = "(" + strings.Join(conStr, pad) + ")"
	return
}
func QueryInject(db *sql.DB, table string, prefix string, col []string, condition map[string]interface{}, extraString string) ([]tableInterface, error) {
	// 如若直接手动拼接查询会存在SQL注入
	var sqlStr string = "SELECT " + sqlColConnect(col) + " FROM `" + prefix + table + "` WHERE " + sqlConditionConnectInject(condition, " AND ") + extraString
	var tableData = make([]tableInterface, 0)
	rows, err := db.Query(sqlStr)

	if err != nil {
		log.Panicln(err)
	}
	if table == dbConfig.TableConfig["queryTable"]["tableName"] {
		for rows.Next() {
			var userRow userinfo
			err := rows.Scan(&userRow.userID, &userRow.userName, &userRow.userEmail, &userRow.userPass, &userRow.userSalt, &userRow.userLoginIP, &userRow.userLoginTime)
			if err != nil {
				log.Panicln(err)
			}
			tableData = append(tableData, userRow)
		}

	} else {
		return nil, nil
	}
	return tableData, nil

}