main_app.py
import sys
import asyncio
from concurrent.futures import ThreadPoolExecutor
import re
import pymysql
import openai
from fastapi import FastAPI
from init import init_db
from config import api_key



init_db()
app = FastAPI()


@app.get('/get_list')
async def get_list(keyword: str = ""):

    print(f"user_input : {repr(keyword)}")


    r, rr = await is_sqli_safe(keyword)
    
    if r == False:
        return f"NO HACK : {rr}"

    db_config = {
        "host": "db",
        "user": "user71293",
        "password": "user948684",
        "database": "mydatabase"
    }


    try:
        conn = pymysql.connect(**db_config)

        c = conn.cursor(pymysql.cursors.DictCursor)

        qry = f"SELECT * FROM application WHERE access_level >= 1 AND description like '%{keyword}%'"
        #print(qry)
        c.execute(qry)

        results = c.fetchall()

        conn.close()

        r = []
        for tmp in results:
            print(tmp)
            r.append([tmp['application_name'], tmp['description']])

        return r
    except:
        return "DB ERROR.."


async def is_sqli_safe(user_input):

    if (len(re.split('[- "]', user_input)) > 1) or (len(user_input) > 150):
        return False, "01"

    if len(user_input) < 5:
        return True, "02"

    try:
        with ThreadPoolExecutor() as executor:
            loop = asyncio.get_event_loop()
            result = await loop.run_in_executor(executor, ask_to_gpt, user_input)

            print(f"result: {result}")
            if result.startswith("<OK>"):
                return True, "03"
            else:
                return False, "04"
    except:
        return False, "05"


def ask_to_gpt(user_input):
    prompt = """- The user will input a string in the form of input: input_text. Let me know whether or not input_text is related to a SQL injection attack.
    - For example, if it contains characters like ', #, --, it is unsafe input.
    - In addition to the example above, please use all the knowledge you have to judge.
    - If it is safe, print "<OK>", if it is unsafe, print "<NO>". Do not output any other explanations. Just respond with "<OK>" or "<NO>" only (no explain).
    """

    openai.api_key = api_key
    completion = openai.ChatCompletion.create(
        model="gpt-3.5-turbo",
        temperature = 0.8,
        max_tokens = 2000,
        messages = [
            {"role": "system", "content": prompt},
            {
                "role": "user", 
                "content": 'input: ' + user_input
            },
        ]
    )


    my_openai_obj = list(completion.choices)[0]

    try:
        content = my_openai_obj.to_dict()['message']['content']
    except:
        content = ""

    return content

I want an input that will pass this condition:if result.startswith("<OK>"):
                return True, "03" and satisfy all preceding conditions. 
I also want to insert a SQLinjection payload inside this input while statisfying the condition



i