中文版提示词
请扮演资深安全工程师，帮助我修复一段存在安全风险的代码。我将提供以下信息：

  • 风险类型：[SQL注入 / XSS / 命令执行]

  • 风险变量：[具体变量名，直接拼接了外部输入]

  • 硬编码敏感信息：[如“密码”“Token”“密钥”等，需替换为环境变量]

  • 相关代码：[粘贴代码块，需注明编程语言]

请完成以下任务：

  1. 重写漏洞逻辑，使用参数化查询（PreparedStatement / 参数化 SQL）或安全转义函数（如 HTML 转义、系统命令转义）替换直接拼接。

  2. 将硬编码的敏感信息（密码/Token/密钥）移除，改为从环境变量（如 process.env、系统环境变量）中读取。

  3. 输出修复后的核心代码片段，并附上一个安全调用的示例（含参数绑定与环境变量配置）。

直接输出修复代码与示例，无需其他内容。

英文版提示词（English Version Prompt）
Please act as a senior security engineer to help me fix a piece of code with security vulnerabilities. I will provide:

  • Risk type: [SQL injection / XSS / command injection]

  • Vulnerable variable: [specific variable name that directly concatenates external input]

  • Hardcoded sensitive info: [e.g., “password,” “Token,” “API key”—to be replaced with environment variables]

  • Relevant code: [paste the code block, specifying the programming language]

Please complete the following:

  1. Rewrite the vulnerable logic using parameterized queries (e.g., PreparedStatement or parameterized SQL) or safe escaping functions (e.g., HTML escaping, system command escaping) to replace direct concatenation.

  2. Remove any hardcoded sensitive information (passwords/Tokens/keys) and replace them with environment‑variable reads (e.g., process.env or system environment variables).

  3. Output the fixed core code snippets along with a secure usage example (including parameter binding and environment variable configuration).

Provide directly the fixed code and example, without any other content.