Product search

Deliberately naive: the query parameter is concatenated straight into SQL. If you can read the statement below, the input reached the application.

✅ Served through my Cloudflare zone

The Host is inside tianshuhuang.com and a CF-Ray is present, so this request passed through my configuration: DDoS protection, WAF, rate limiting, and any Access policy on this path.

CF-Ray	`a3686fd34dad258a-CMH`
Edge location	`CMH`
Your IP (CF-Connecting-IP)	`216.73.216.174`
Your country (CF-IPCountry)	`US`
Origin secret header	`present`
Host	`www.tianshuhuang.com`

Query the application would have run

SELECT id, name, price FROM products WHERE name = 'laptop'

Received q = laptop — 6 characters.

Results

No database is attached; this endpoint exists only to show what does and does not survive the Cloudflare WAF.