白名单映射示例（Python）
白名单映射示例（Python）
SORT_WHITELIST = {
"name": "name",
"created_at": "created_at",
"score": "score",
}
col = SORT_WHITELIST.get(request.args.get("sort"), "created_at")
sql = f"SELECT * FROM items ORDER BY {col} ASC" # col 来自白名单而非用户输入白名单之外一律回退默认值；不要试图用关键字过滤或转义来处理这些位置。