توصيات الإصلاح اللي تتنفّد فعلاً

vague = ["Fix the vulnerability", "Improve security", "Update software"]

good = [
    {
        "action": "Use prepared statements in login.php for all SQL queries",
        "example": 'cur.execute("SELECT * FROM users WHERE name = %s", (name,))',
        "short_term": "Block payloads like ' OR 1=1 with the WAF",
        "long_term": "Train developers on OWASP secure coding",
        "verify": "Re-run the payload: login must fail",
    }
]

print("Vague:", vague)
for r in good:
    for k, v in r.items():
        print(f"{k}: {v}")

Vague: ['Fix the vulnerability', 'Improve security', 'Update software']
action: Use prepared statements in login.php for all SQL queries
example: cur.execute("SELECT * FROM users WHERE name = %s", (name,))
short_term: Block payloads like ' OR 1=1 with the WAF
long_term: Train developers on OWASP secure coding
verify: Re-run the payload: login must fail

vague = ["Fix the vulnerability", "Improve security", "Update software"]

good = [
    {
        "action": "Use prepared statements in login.php for all SQL queries",
        "example": 'cur.execute("SELECT * FROM users WHERE name = %s", (name,))',
        "short_term": "Block payloads like ' OR 1=1 with the WAF",
        "long_term": "Train developers on OWASP secure coding",
        "verify": "Re-run the payload: login must fail",
    },
    {
        "action": "Change the default admin password to a long random one",
        "example": "openssl rand -base64 24",
        "short_term": "Disable the admin account until it is changed",
        "long_term": "Enforce a password policy and MFA for admins",
        "verify": "Login with admin:admin must fail",
    },
]

print("Vague:", vague)
for r in good:
    for k, v in r.items():
        print(f"{k}: {v}")

Vague: ['Fix the vulnerability', 'Improve security', 'Update software']
action: Use prepared statements in login.php for all SQL queries
example: cur.execute("SELECT * FROM users WHERE name = %s", (name,))
short_term: Block payloads like ' OR 1=1 with the WAF
long_term: Train developers on OWASP secure coding
verify: Re-run the payload: login must fail
action: Change the default admin password to a long random one
example: openssl rand -base64 24
short_term: Disable the admin account until it is changed
long_term: Enforce a password policy and MFA for admins
verify: Login with admin:admin must fail