← API network SECURITY / SQLI / XSS / PAYLOAD ANALYSIS

Direct Platform v0.0.2 / General Availability api.dakidarts.comDirect gateway

SQL Injection / XSS Payload Detector API

Local security analysis for SQL injection and XSS payloads, encoded input layers, URLs and HTTP headers, with batch scanning and reusable payload catalogs.

Preview examples View on RapidAPI OpenAPI 3.1 ↗ GitHub repository ↗ Release feed ↗

Direct PlatformSQ

api.dakidarts.comv0.0.2General Availability25ms p9522 documented endpoints

DIRECT NATIVE API

Call SQL Injection / XSS Payload Detector API through the Dakidarts gateway.

0 of 22 endpoints have an upstream URL configured. Other routes return 503 before billing; only send live requests to configured routes. The gateway injects upstream credentials for you.

Live checkout opens after an API route has an upstream URL. Preview examples are available below.

Base URLhttps://api.dakidarts.com/sqli-xss-detector

AuthenticationX-API-Key: dk_live_...

Default reference pathGET /detect

Commercial modelPay-as-you-go / $0.0050 per call

01 / ACCESS

One key, one gateway

Use a Dakidarts API key with read or write scopes and control which APIs that key can reach.

02 / BILLING

Metered by the call

Wallet credits, plan quotas and organization invoices are settled per request with transparent response headers.

03 / RELIABILITY

Observable by default

Latency, upstream status and execution mode are logged so integration issues are visible before they spread.

RAPIDAPI SPOTLIGHTRapidAPI Marketplace

Also available through RapidAPI.

Keep the direct Dakidarts gateway as your primary route, or use the RapidAPI listing when marketplace billing and key management fit your stack better.

View on RapidAPI Plans, keys and usage stay inside RapidAPI.

CAPABILITIES

Built to disappear into the product.

The best API is the one your team can integrate, observe and then stop thinking about.

Add a detection layer to forms and gateways

Designed as a composable building block for product teams, internal tooling and automation.

Support WAF-style inspection workflows

Designed as a composable building block for product teams, internal tooling and automation.

Return machine-readable security signals

Designed as a composable building block for product teams, internal tooling and automation.

PLATFORM FACTS

The shape of the surface.

Selected facts about coverage, delivery and production readiness.

01SQL injection detection

02XSS detection

03Encoded-input analysis and risk scoring

FAQ

Answers before you integrate.

Access, billing and integration details for SQL Injection / XSS Payload Detector API.

What does the detector look for? +

SQL injection and cross-site scripting payload patterns in supplied input.

Is it a web application firewall? +

No. It is a detection utility that complements a WAF and secure coding practices.

Can I use it on form input? +

Yes, as an additional signal alongside output encoding and parameterized queries.

How do I get access? +

Subscribe on the Dakidarts dashboard, then call the gateway with an API key.

Does it catch every attack? +

No detector is complete. Keep defense in depth and do not rely on a single check.

SUBSCRIPTION PLANS

Choose a quota that matches the workload.

Plans are shown for reference. Live checkout opens after an API route has an upstream URL.

WALLET-ACCESS

Pay-as-you-go access

$0.00 / month

Wallet credits per call
$0.0050 / call overage
120 req/min

INTEGRATION PATH

From first request to production.

Start with a Dakidarts key, call the gateway, then monitor usage from the dashboard.

Create a Dakidarts key

Choose the API scope, then copy the key into your server environment.

Call the gateway

Send requests to https://api.dakidarts.com/sqli-xss-detector with your key and JSON body.

Watch usage

Track calls, latency and spend from the API dashboard and wallet.

ENDPOINT REFERENCE

Endpoint reference & metered costs.

These routes include contracts imported from the product implementation. 0 of 22 endpoints have an upstream URL configured. Other routes return 503 before billing; saved examples are previews only. Configure an upstream URL in API Studio to enable those routes.

GROUP / 01

Operations

Operations endpoints sourced from the SQL Injection / XSS Payload Detector API implementation.

3 endpoints

GET / Index SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Service banner.

`GET /`

Service banner.

{
  "service": "SQL & XSS Detection API",
  "version": "v0.0.2",
  "description": "...",
  "docs": "see /meta for full endpoint listing"
}

Source contract imported from sql xss detection/app.py. Handler: index. Reference: docs/endpoints.md.

QUICK CURL

curl -X GET https://api.dakidarts.com/sqli-xss-detector/ -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

GET /status Health SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Health + version check. `200 OK`.

`GET /status`

Health + version check. 200 OK.

{ "status": "ok", "service": "SQL & XSS Detection API", "version": "v0.0.2" }

Source contract imported from sql xss detection/app.py. Handler: health. Reference: docs/endpoints.md.

QUICK CURL

curl -X GET https://api.dakidarts.com/sqli-xss-detector/status -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

GET /meta Meta SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

API metadata: version, description, full endpoint listing, BYOK headers.

`GET /meta`

API metadata: version, description, full endpoint listing, BYOK headers.

{
  "service": "SQL & XSS Detection API",
  "version": "v0.0.2",
  "endpoints": [ { "path": "/detect", "methods": ["GET", "POST"], "description": "..." } ],
  "byok_headers": {
    "X-GSB-Key": "Google Safe Browsing API key (optional)",
    "X-Virustotal-Key": "VirusTotal API key (optional)"
  }
}

Source contract imported from sql xss detection/app.py. Handler: meta. Reference: docs/endpoints.md.

QUICK CURL

curl -X GET https://api.dakidarts.com/sqli-xss-detector/meta -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

GROUP / 02

Analysis

Analysis endpoints sourced from the SQL Injection / XSS Payload Detector API implementation.

12 endpoints

GET /detect Detect SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Detect the risk of a user input string or payload across all 10 attack categories.

1. Detect Payload — `POST /detect` / `GET /detect`

Detect the risk of a user input string or payload across all 10 attack categories.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	User input or payload to check. Max 10,000 chars.	`' OR 1=1--`, `<script>alert(1)</script>`, `../../etc/passwd`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"input": "' OR 1=1--"}'

Example Response

{
  "input": "' OR 1=1--",
  "risk": "exploit attempt",
  "severity": "high",
  "score": 60,
  "categories": {
    "sqli": true,
    "xss": false,
    "command_injection": false,
    "path_traversal": false,
    "nosql_injection": false,
    "ssti": false,
    "ldap_injection": false,
    "formula_injection": false,
    "crlf_injection": false,
    "open_redirect": false
  },
  "matches": [
    { "category": "sqli", "label": "boolean-based tautology", "evidence": "or 1=1", "weight": 20 },
    { "category": "sqli", "label": "SQL string terminator", "evidence": "'", "weight": 10 },
    { "category": "obfuscation", "label": "encoded / obfuscated payload", "evidence": "", "weight": 10 }
  ],
  "matched_keywords": [],
  "was_obfuscated": false,
  "encoding_layers": [],
  "recommendations": [
    "Use parameterized queries / prepared statements. Never concatenate user input into SQL. Apply least-privilege DB accounts."
  ]
}

GET Request Example

curl "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect?input=%3Cscript%3Ealert(1)%3C%2Fscript%3E" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY"

Response:

{
  "input": "%3Cscript%3Ealert(1)%3C%2Fscript%3E",
  "risk": "exploit attempt",
  "severity": "high",
  "score": 70,
  "categories": { "xss": true, "sqli": false },
  "matches": [ { "category": "xss", "label": "script tag injection", "evidence": "<script>", "weight": 30 } ],
  "was_obfuscated": true,
  "encoding_layers": ["url"]
}

Source contract imported from sql xss detection/app.py. Handler: detect. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`input`	query	string	Yes	Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.

QUICK CURL

curl -X GET https://api.dakidarts.com/sqli-xss-detector/detect -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /detect Detect SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Detect the risk of a user input string or payload across all 10 attack categories.

1. Detect Payload — `POST /detect` / `GET /detect`

Detect the risk of a user input string or payload across all 10 attack categories.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	User input or payload to check. Max 10,000 chars.	`' OR 1=1--`, `<script>alert(1)</script>`, `../../etc/passwd`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"input": "' OR 1=1--"}'

Example Response

{
  "input": "' OR 1=1--",
  "risk": "exploit attempt",
  "severity": "high",
  "score": 60,
  "categories": {
    "sqli": true,
    "xss": false,
    "command_injection": false,
    "path_traversal": false,
    "nosql_injection": false,
    "ssti": false,
    "ldap_injection": false,
    "formula_injection": false,
    "crlf_injection": false,
    "open_redirect": false
  },
  "matches": [
    { "category": "sqli", "label": "boolean-based tautology", "evidence": "or 1=1", "weight": 20 },
    { "category": "sqli", "label": "SQL string terminator", "evidence": "'", "weight": 10 },
    { "category": "obfuscation", "label": "encoded / obfuscated payload", "evidence": "", "weight": 10 }
  ],
  "matched_keywords": [],
  "was_obfuscated": false,
  "encoding_layers": [],
  "recommendations": [
    "Use parameterized queries / prepared statements. Never concatenate user input into SQL. Apply least-privilege DB accounts."
  ]
}

GET Request Example

curl "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect?input=%3Cscript%3Ealert(1)%3C%2Fscript%3E" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY"

Response:

{
  "input": "%3Cscript%3Ealert(1)%3C%2Fscript%3E",
  "risk": "exploit attempt",
  "severity": "high",
  "score": 70,
  "categories": { "xss": true, "sqli": false },
  "matches": [ { "category": "xss", "label": "script tag injection", "evidence": "<script>", "weight": 30 } ],
  "was_obfuscated": true,
  "encoding_layers": ["url"]
}

Source contract imported from sql xss detection/app.py. Handler: detect. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`input`	body	string	Yes	Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.

SAMPLE RESPONSE

{
  "risk": "exploit attempt",
  "input": "' OR 1=1--",
  "score": 60,
  "matches": [
    {
      "label": "boolean-based tautology",
      "weight": 20,
      "category": "sqli",
      "evidence": "or 1=1"
    },
    {
      "label": "SQL string terminator",
      "weight": 10,
      "category": "sqli",
      "evidence": "'"
    },
    {
      "label": "encoded / obfuscated payload",
      "weight": 10,
      "category": "obfuscation",
      "evidence": ""
    }
  ],
  "severity": "high",
  "categories": {
    "xss": false,
    "sqli": true,
    "ssti": false,
    "open_redirect": false,
    "crlf_injection": false,
    "ldap_injection": false,
    "path_traversal": false,
    "nosql_injection": false,
    "command_injection": false,
    "formula_injection": false
  },
  "was_obfuscated": false,
  "encoding_layers": [],
  "recommendations": [
    "Use parameterized queries / prepared statements. Never concatenate user input into SQL. Apply least-privilege DB accounts."
  ],
  "matched_keywords": []
}

QUICK CURL

curl -X POST https://api.dakidarts.com/sqli-xss-detector/detect -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"input": "example"}'

GET /detect/sqli Detect Sqli SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Detect SQL injection only: quotes, boolean tautologies, UNION-based, time-based, error-based, stacked queries, and file read/write attempts.

2. Detect SQL Injection — `POST /detect/sqli` / `GET /detect/sqli`

Detect SQL injection only: quotes, boolean tautologies, UNION-based, time-based, error-based, stacked queries, and file read/write attempts.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect/sqli

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	String to scan for SQLi. Max 10,000 chars.	`1' UNION SELECT @@version--`, `1 AND SLEEP(5)--`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect/sqli" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"input": "1'\'' UNION SELECT @@version--"}'

Example Response

{
  "input": "1' UNION SELECT @@version--",
  "category": "sqli",
  "risk": "exploit attempt",
  "severity": "critical",
  "score": 85,
  "matches": [
    { "category": "sqli", "label": "UNION-based injection", "evidence": "union select", "weight": 30 },
    { "category": "sqli", "label": "SQL string terminator", "evidence": "'", "weight": 10 }
  ],
  "was_obfuscated": false,
  "encoding_layers": []
}

Source contract imported from sql xss detection/app.py. Handler: detect_sqli. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`input`	query	string	Yes	Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.

QUICK CURL

curl -X GET https://api.dakidarts.com/sqli-xss-detector/detect/sqli -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /detect/sqli Detect Sqli SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Detect SQL injection only: quotes, boolean tautologies, UNION-based, time-based, error-based, stacked queries, and file read/write attempts.

2. Detect SQL Injection — `POST /detect/sqli` / `GET /detect/sqli`

Detect SQL injection only: quotes, boolean tautologies, UNION-based, time-based, error-based, stacked queries, and file read/write attempts.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect/sqli

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	String to scan for SQLi. Max 10,000 chars.	`1' UNION SELECT @@version--`, `1 AND SLEEP(5)--`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect/sqli" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"input": "1'\'' UNION SELECT @@version--"}'

Example Response

{
  "input": "1' UNION SELECT @@version--",
  "category": "sqli",
  "risk": "exploit attempt",
  "severity": "critical",
  "score": 85,
  "matches": [
    { "category": "sqli", "label": "UNION-based injection", "evidence": "union select", "weight": 30 },
    { "category": "sqli", "label": "SQL string terminator", "evidence": "'", "weight": 10 }
  ],
  "was_obfuscated": false,
  "encoding_layers": []
}

Source contract imported from sql xss detection/app.py. Handler: detect_sqli. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`input`	body	string	Yes	Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.

SAMPLE RESPONSE

{
  "risk": "exploit attempt",
  "input": "1' UNION SELECT @@version--",
  "score": 85,
  "matches": [
    {
      "label": "UNION-based injection",
      "weight": 30,
      "category": "sqli",
      "evidence": "union select"
    },
    {
      "label": "SQL string terminator",
      "weight": 10,
      "category": "sqli",
      "evidence": "'"
    }
  ],
  "category": "sqli",
  "severity": "critical",
  "was_obfuscated": false,
  "encoding_layers": []
}

QUICK CURL

curl -X POST https://api.dakidarts.com/sqli-xss-detector/detect/sqli -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"input": "example"}'

GET /detect/xss Detect Xss SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Detect cross-site scripting only: script tags, inline event handlers, `javascript:` URIs, dangerous HTML tags, and JS sinks.

3. Detect XSS — `POST /detect/xss` / `GET /detect/xss`

Detect cross-site scripting only: script tags, inline event handlers, javascript: URIs, dangerous HTML tags, and JS sinks.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect/xss

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	String to scan for XSS. Max 10,000 chars.	`<svg/onload=alert(1)>`, `<img src=x onerror=alert(1)>`

Example Request (GET)

curl "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect/xss?input=%3Csvg%2Fonload%3Dalert(1)%3E" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY"

Example Response

{
  "input": "<svg/onload=alert(1)>",
  "category": "xss",
  "risk": "exploit attempt",
  "severity": "high",
  "score": 70,
  "matches": [
    { "category": "xss", "label": "script tag injection", "evidence": "<svg/onload", "weight": 25 },
    { "category": "xss", "label": "malicious JS sink", "evidence": "alert(", "weight": 25 }
  ],
  "was_obfuscated": false,
  "encoding_layers": []
}

Source contract imported from sql xss detection/app.py. Handler: detect_xss. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`input`	query	string	Yes	Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.

SAMPLE RESPONSE

{
  "risk": "exploit attempt",
  "input": "<svg/onload=alert(1)>",
  "score": 70,
  "matches": [
    {
      "label": "script tag injection",
      "weight": 25,
      "category": "xss",
      "evidence": "<svg/onload"
    },
    {
      "label": "malicious JS sink",
      "weight": 25,
      "category": "xss",
      "evidence": "alert("
    }
  ],
  "category": "xss",
  "severity": "high",
  "was_obfuscated": false,
  "encoding_layers": []
}

QUICK CURL

curl -X GET https://api.dakidarts.com/sqli-xss-detector/detect/xss -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /detect/xss Detect Xss SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Detect cross-site scripting only: script tags, inline event handlers, `javascript:` URIs, dangerous HTML tags, and JS sinks.

3. Detect XSS — `POST /detect/xss` / `GET /detect/xss`

Detect cross-site scripting only: script tags, inline event handlers, javascript: URIs, dangerous HTML tags, and JS sinks.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect/xss

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	String to scan for XSS. Max 10,000 chars.	`<svg/onload=alert(1)>`, `<img src=x onerror=alert(1)>`

Example Request (GET)

curl "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect/xss?input=%3Csvg%2Fonload%3Dalert(1)%3E" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY"

Example Response

{
  "input": "<svg/onload=alert(1)>",
  "category": "xss",
  "risk": "exploit attempt",
  "severity": "high",
  "score": 70,
  "matches": [
    { "category": "xss", "label": "script tag injection", "evidence": "<svg/onload", "weight": 25 },
    { "category": "xss", "label": "malicious JS sink", "evidence": "alert(", "weight": 25 }
  ],
  "was_obfuscated": false,
  "encoding_layers": []
}

Source contract imported from sql xss detection/app.py. Handler: detect_xss. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`input`	body	string	Yes	Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.

QUICK CURL

curl -X POST https://api.dakidarts.com/sqli-xss-detector/detect/xss -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"input": "example"}'

GET /analyze Analyze SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Full detection plus forensic analysis: decoded value, encoding layers, Shannon entropy, printable-character ratio, and non-ASCII characters. Perfect for WAF log review and threat triage.

5. Deep Analysis — `POST /analyze` / `GET /analyze`

Full detection plus forensic analysis: decoded value, encoding layers, Shannon entropy, printable-character ratio, and non-ASCII characters. Perfect for WAF log review and threat triage.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/analyze

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	String to analyze. Max 10,000 chars.	`%3Cscript%3Ealert(1)%3C%2Fscript%3E`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/analyze" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"input": "%3Cscript%3Ealert(1)%3C%2Fscript%3E"}'

Example Response

{
  "input": "%3Cscript%3Ealert(1)%3C%2Fscript%3E",
  "risk": "exploit attempt",
  "severity": "high",
  "score": 70,
  "categories": { "xss": true },
  "matches": [ { "category": "xss", "label": "script tag injection", "evidence": "<script>", "weight": 30 } ],
  "was_obfuscated": true,
  "encoding_layers": ["url"],
  "recommendations": [
    "Context-aware output encoding, strict Content-Security-Policy, and sanitize untrusted HTML server-side."
  ],
  "analysis": {
    "original_length": 33,
    "decoded_length": 21,
    "entropy": 3.783,
    "printable_ratio": 1.0,
    "decoded_value": "<script>alert(1)</script>",
    "non_ascii_chars": []
  }
}

Source contract imported from sql xss detection/app.py. Handler: analyze. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`input`	query	string	Yes	Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.

QUICK CURL

curl -X GET https://api.dakidarts.com/sqli-xss-detector/analyze -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /analyze Analyze SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Full detection plus forensic analysis: decoded value, encoding layers, Shannon entropy, printable-character ratio, and non-ASCII characters. Perfect for WAF log review and threat triage.

5. Deep Analysis — `POST /analyze` / `GET /analyze`

Full detection plus forensic analysis: decoded value, encoding layers, Shannon entropy, printable-character ratio, and non-ASCII characters. Perfect for WAF log review and threat triage.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/analyze

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	String to analyze. Max 10,000 chars.	`%3Cscript%3Ealert(1)%3C%2Fscript%3E`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/analyze" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"input": "%3Cscript%3Ealert(1)%3C%2Fscript%3E"}'

Example Response

{
  "input": "%3Cscript%3Ealert(1)%3C%2Fscript%3E",
  "risk": "exploit attempt",
  "severity": "high",
  "score": 70,
  "categories": { "xss": true },
  "matches": [ { "category": "xss", "label": "script tag injection", "evidence": "<script>", "weight": 30 } ],
  "was_obfuscated": true,
  "encoding_layers": ["url"],
  "recommendations": [
    "Context-aware output encoding, strict Content-Security-Policy, and sanitize untrusted HTML server-side."
  ],
  "analysis": {
    "original_length": 33,
    "decoded_length": 21,
    "entropy": 3.783,
    "printable_ratio": 1.0,
    "decoded_value": "<script>alert(1)</script>",
    "non_ascii_chars": []
  }
}

Source contract imported from sql xss detection/app.py. Handler: analyze. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`input`	body	string	Yes	Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.

SAMPLE RESPONSE

{
  "risk": "exploit attempt",
  "input": "%3Cscript%3Ealert(1)%3C%2Fscript%3E",
  "score": 70,
  "matches": [
    {
      "label": "script tag injection",
      "weight": 30,
      "category": "xss",
      "evidence": "<script>"
    }
  ],
  "analysis": {
    "entropy": 3.783,
    "decoded_value": "<script>alert(1)</script>",
    "decoded_length": 21,
    "non_ascii_chars": [],
    "original_length": 33,
    "printable_ratio": 1.0
  },
  "severity": "high",
  "categories": {
    "xss": true
  },
  "was_obfuscated": true,
  "encoding_layers": [
    "url"
  ],
  "recommendations": [
    "Context-aware output encoding, strict Content-Security-Policy, and sanitize untrusted HTML server-side."
  ]
}

QUICK CURL

curl -X POST https://api.dakidarts.com/sqli-xss-detector/analyze -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"input": "example"}'

GET /analyze/url Analyze Url SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Analyze a URL locally (open redirect, path traversal, CRLF injection, scheme checks) and optionally query external threat-intel providers using **your own keys**. If a key is omitted, that provider is simply skipped — the call never fails.

6. Analyze URL (BYOK) — `POST /analyze/url` / `GET /analyze/url`

Analyze a URL locally (open redirect, path traversal, CRLF injection, scheme checks) and optionally query external threat-intel providers using your own keys. If a key is omitted, that provider is simply skipped — the call never fails.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/analyze/url

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	URL to analyze. Scheme auto-added if missing. Max 10,000 chars.	`https://example.com/redirect?url=//evil.com`, `evil.com`
X-GSB-Key (header)	string	Optional	Your Google Safe Browsing API v4 key.	`AIzaSy...`
X-Virustotal-Key (header)	string	Optional	Your VirusTotal API v3 key.	`0a9f...`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/analyze/url" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-H "X-GSB-Key: YOUR_GOOGLE_SAFE_BROWSING_KEY" \
-H "X-Virustotal-Key: YOUR_VIRUSTOTAL_KEY" \
-d '{"input": "https://example.com/redirect?url=//evil.com"}'

Example Response

{
  "input": "https://example.com/redirect?url=//evil.com",
  "scheme": "https",
  "host": "example.com",
  "path": "/redirect",
  "query": "url=//evil.com",
  "risk": "suspicious",
  "severity": "medium",
  "score": 40,
  "findings": [
    { "label": "redirect parameter", "evidence": "url=//evil.com", "weight": 25 }
  ],
  "was_obfuscated": false,
  "encoding_layers": [],
  "external": {
    "google_safe_browsing": {
      "status": "ok",
      "service": "google_safe_browsing",
      "threat_found": false,
      "matches": []
    },
    "virustotal": {
      "status": "ok",
      "service": "virustotal",
      "url": "https://example.com/redirect?url=//evil.com",
      "stats": { "malicious": 0, "suspicious": 0, "harmless": 60, "undetected": 10, "timeout": 0 },
      "malicious": 0,
      "reputation": -7
    }
  },
  "note": "External checks only run when X-GSB-Key / X-Virustotal-Key headers are supplied (BYOK)."
}

Source contract imported from sql xss detection/app.py. Handler: analyze_url. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`X-GSB-Key`	header	string	No	Optional Google Safe Browsing API key for external URL reputation checks (BYOK).
`X-Virustotal-Key`	header	string	No	Optional VirusTotal API key for external URL reputation checks (BYOK).
`input`	query	string	Yes	Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.

QUICK CURL

curl -X GET https://api.dakidarts.com/sqli-xss-detector/analyze/url -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'X-GSB-Key: YOUR_X_GSB_KEY' -H 'X-Virustotal-Key: YOUR_X_VIRUSTOTAL_KEY'

POST /analyze/url Analyze Url SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

6. Analyze URL (BYOK) — `POST /analyze/url` / `GET /analyze/url`

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/analyze/url

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	URL to analyze. Scheme auto-added if missing. Max 10,000 chars.	`https://example.com/redirect?url=//evil.com`, `evil.com`
X-GSB-Key (header)	string	Optional	Your Google Safe Browsing API v4 key.	`AIzaSy...`
X-Virustotal-Key (header)	string	Optional	Your VirusTotal API v3 key.	`0a9f...`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/analyze/url" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-H "X-GSB-Key: YOUR_GOOGLE_SAFE_BROWSING_KEY" \
-H "X-Virustotal-Key: YOUR_VIRUSTOTAL_KEY" \
-d '{"input": "https://example.com/redirect?url=//evil.com"}'

Example Response

{
  "input": "https://example.com/redirect?url=//evil.com",
  "scheme": "https",
  "host": "example.com",
  "path": "/redirect",
  "query": "url=//evil.com",
  "risk": "suspicious",
  "severity": "medium",
  "score": 40,
  "findings": [
    { "label": "redirect parameter", "evidence": "url=//evil.com", "weight": 25 }
  ],
  "was_obfuscated": false,
  "encoding_layers": [],
  "external": {
    "google_safe_browsing": {
      "status": "ok",
      "service": "google_safe_browsing",
      "threat_found": false,
      "matches": []
    },
    "virustotal": {
      "status": "ok",
      "service": "virustotal",
      "url": "https://example.com/redirect?url=//evil.com",
      "stats": { "malicious": 0, "suspicious": 0, "harmless": 60, "undetected": 10, "timeout": 0 },
      "malicious": 0,
      "reputation": -7
    }
  },
  "note": "External checks only run when X-GSB-Key / X-Virustotal-Key headers are supplied (BYOK)."
}

Source contract imported from sql xss detection/app.py. Handler: analyze_url. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`X-GSB-Key`	header	string	No	Optional Google Safe Browsing API key for external URL reputation checks (BYOK).
`X-Virustotal-Key`	header	string	No	Optional VirusTotal API key for external URL reputation checks (BYOK).
`input`	body	string	Yes	Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.

SAMPLE RESPONSE

{
  "host": "example.com",
  "note": "External checks only run when X-GSB-Key / X-Virustotal-Key headers are supplied (BYOK).",
  "path": "/redirect",
  "risk": "suspicious",
  "input": "https://example.com/redirect?url=//evil.com",
  "query": "url=//evil.com",
  "score": 40,
  "scheme": "https",
  "external": {
    "virustotal": {
      "url": "https://example.com/redirect?url=//evil.com",
      "stats": {
        "timeout": 0,
        "harmless": 60,
        "malicious": 0,
        "suspicious": 0,
        "undetected": 10
      },
      "status": "ok",
      "service": "virustotal",
      "malicious": 0,
      "reputation": -7
    },
    "google_safe_browsing": {
      "status": "ok",
      "matches": [],
      "service": "google_safe_browsing",
      "threat_found": false
    }
  },
  "findings": [
    {
      "label": "redirect parameter",
      "weight": 25,
      "evidence": "url=//evil.com"
    }
  ],
  "severity": "medium",
  "was_obfuscated": false,
  "encoding_layers": []
}

QUICK CURL

curl -X POST https://api.dakidarts.com/sqli-xss-detector/analyze/url -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'X-GSB-Key: YOUR_X_GSB_KEY' -H 'X-Virustotal-Key: YOUR_X_VIRUSTOTAL_KEY' -H 'Content-Type: application/json' -d '{"input": "example"}'

GET /scan/headers Scan Headers SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Audit a set of HTTP response headers. Reports missing security headers (CSP, HSTS, X-Frame-Options, etc.) and any CRLF/header-injection evidence.

7. HTTP Security Header Audit — `POST /scan/headers` / `GET /scan/headers`

Audit a set of HTTP response headers. Reports missing security headers (CSP, HSTS, X-Frame-Options, etc.) and any CRLF/header-injection evidence.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/scan/headers

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
headers	object	Yes	JSON object of header name → value.	`{"Content-Security-Policy": "default-src 'self'", "Set-Cookie": "sid=abc"}`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/scan/headers" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"headers": {"Content-Security-Policy": "default-src '\''self'\''", "X-Frame-Options": "DENY", "Set-Cookie": "sid=abc; HttpOnly"}}'

Example Response

{
  "headers": {
    "content-security-policy": "default-src 'self'",
    "x-frame-options": "DENY",
    "set-cookie": "sid=abc; HttpOnly"
  },
  "missing_security_headers": [
    "Strict-Transport-Security",
    "X-Content-Type-Options",
    "X-XSS-Protection",
    "Referrer-Policy",
    "Permissions-Policy",
    "Cross-Origin-Opener-Policy",
    "Cross-Origin-Resource-Policy"
  ],
  "security_headers_present": {
    "Content-Security-Policy": "default-src 'self'",
    "X-Frame-Options": "DENY"
  },
  "injection_found": {},
  "recommendations": [
    "Missing security headers: Strict-Transport-Security, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy"
  ]
}

Source contract imported from sql xss detection/app.py. Handler: scan_headers. Reference: RAPID_README.md.

RESPONSE SHAPE / NO VERIFIED SAMPLE

{
  "type": "object",
  "properties": {
    "headers": {
      "type": "object",
      "properties": {
        "header-name": {
          "type": "string"
        }
      },
      "additionalProperties": true
    },
    "injection_found": {
      "type": "object",
      "properties": {
        "header-name": {
          "type": "object",
          "properties": {
            "type": {
              "type": "string"
            },
            "evidence": {
              "type": "string"
            }
          },
          "additionalProperties": true
        }
      },
      "additionalProperties": true
    },
    "recommendations": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "missing_security_headers": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "security_headers_present": {
      "type": "object",
      "properties": {
        "header-name": {
          "type": "string"
        }
      },
      "additionalProperties": true
    }
  },
  "additionalProperties": true
}

QUICK CURL

curl -X GET https://api.dakidarts.com/sqli-xss-detector/scan/headers -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /scan/headers Scan Headers SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Audit a set of HTTP response headers. Reports missing security headers (CSP, HSTS, X-Frame-Options, etc.) and any CRLF/header-injection evidence.

7. HTTP Security Header Audit — `POST /scan/headers` / `GET /scan/headers`

Audit a set of HTTP response headers. Reports missing security headers (CSP, HSTS, X-Frame-Options, etc.) and any CRLF/header-injection evidence.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/scan/headers

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
headers	object	Yes	JSON object of header name → value.	`{"Content-Security-Policy": "default-src 'self'", "Set-Cookie": "sid=abc"}`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/scan/headers" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"headers": {"Content-Security-Policy": "default-src '\''self'\''", "X-Frame-Options": "DENY", "Set-Cookie": "sid=abc; HttpOnly"}}'

Example Response

{
  "headers": {
    "content-security-policy": "default-src 'self'",
    "x-frame-options": "DENY",
    "set-cookie": "sid=abc; HttpOnly"
  },
  "missing_security_headers": [
    "Strict-Transport-Security",
    "X-Content-Type-Options",
    "X-XSS-Protection",
    "Referrer-Policy",
    "Permissions-Policy",
    "Cross-Origin-Opener-Policy",
    "Cross-Origin-Resource-Policy"
  ],
  "security_headers_present": {
    "Content-Security-Policy": "default-src 'self'",
    "X-Frame-Options": "DENY"
  },
  "injection_found": {},
  "recommendations": [
    "Missing security headers: Strict-Transport-Security, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy"
  ]
}

Source contract imported from sql xss detection/app.py. Handler: scan_headers. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`headers`	body	object	No	Optional HTTP header-name/value object to inspect. If omitted, incoming request headers are analyzed.

SAMPLE RESPONSE

{
  "headers": {
    "set-cookie": "sid=abc; HttpOnly",
    "x-frame-options": "DENY",
    "content-security-policy": "default-src 'self'"
  },
  "injection_found": {},
  "recommendations": [
    "Missing security headers: Strict-Transport-Security, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy"
  ],
  "missing_security_headers": [
    "Strict-Transport-Security",
    "X-Content-Type-Options",
    "X-XSS-Protection",
    "Referrer-Policy",
    "Permissions-Policy",
    "Cross-Origin-Opener-Policy",
    "Cross-Origin-Resource-Policy"
  ],
  "security_headers_present": {
    "X-Frame-Options": "DENY",
    "Content-Security-Policy": "default-src 'self'"
  }
}

QUICK CURL

curl -X POST https://api.dakidarts.com/sqli-xss-detector/scan/headers -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"headers": {"X-Frame-Options": "DENY"}}'

GROUP / 03

Batch operations

Batch operations endpoints sourced from the SQL Injection / XSS Payload Detector API implementation.

2 endpoints

GET /detect/batch Detect Batch SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Scan up to **100 inputs** in a single call. Each input is scanned independently; per-input results are returned in order.

4. Batch Detect — `POST /detect/batch` / `GET /detect/batch`

Scan up to 100 inputs in a single call. Each input is scanned independently; per-input results are returned in order.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect/batch

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
inputs	array	Yes	JSON array of strings to scan (max 100).	`["' OR 1=1--", "<script>alert(1)</script>"]`
input (alt)	string	Optional	Multiple `input` query params: `?input=a&input=b`	`?input=a&input=b`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect/batch" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"inputs": ["'\'' OR 1=1--", "<script>alert(1)</script>", "safe text", "../../etc/passwd"]}'

Example Response

{
  "count": 4,
  "results": [
    { "input": "' OR 1=1--", "risk": "exploit attempt", "score": 60 },
    { "input": "<script>alert(1)</script>", "risk": "exploit attempt", "score": 100 },
    { "input": "safe text", "risk": "safe", "score": 0 },
    { "input": "../../etc/passwd", "risk": "exploit attempt", "score": 80 }
  ],
  "errors": []
}

Source contract imported from sql xss detection/app.py. Handler: detect_batch. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`input`	query	string	Yes	Up to 100 input strings. POST JSON uses an `inputs` array; GET accepts repeated `input` query values.

RESPONSE SHAPE / NO VERIFIED SAMPLE

{
  "type": "object",
  "properties": {
    "count": {
      "type": "integer"
    },
    "errors": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "error": {
            "type": "string"
          },
          "input": {}
        },
        "additionalProperties": true
      }
    },
    "results": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {},
        "additionalProperties": true
      }
    }
  },
  "additionalProperties": true
}

QUICK CURL

curl -X GET 'https://api.dakidarts.com/sqli-xss-detector/detect/batch?input=SELECT+%2A+FROM+users' -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /detect/batch Detect Batch SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Scan up to **100 inputs** in a single call. Each input is scanned independently; per-input results are returned in order.

4. Batch Detect — `POST /detect/batch` / `GET /detect/batch`

Scan up to 100 inputs in a single call. Each input is scanned independently; per-input results are returned in order.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect/batch

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
inputs	array	Yes	JSON array of strings to scan (max 100).	`["' OR 1=1--", "<script>alert(1)</script>"]`
input (alt)	string	Optional	Multiple `input` query params: `?input=a&input=b`	`?input=a&input=b`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/detect/batch" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"inputs": ["'\'' OR 1=1--", "<script>alert(1)</script>", "safe text", "../../etc/passwd"]}'

Example Response

{
  "count": 4,
  "results": [
    { "input": "' OR 1=1--", "risk": "exploit attempt", "score": 60 },
    { "input": "<script>alert(1)</script>", "risk": "exploit attempt", "score": 100 },
    { "input": "safe text", "risk": "safe", "score": 0 },
    { "input": "../../etc/passwd", "risk": "exploit attempt", "score": 80 }
  ],
  "errors": []
}

Source contract imported from sql xss detection/app.py. Handler: detect_batch. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`inputs`	body	array	Yes	Up to 100 input strings. POST JSON uses an `inputs` array; GET accepts repeated `input` query values.

SAMPLE RESPONSE

{
  "count": 4,
  "errors": [],
  "results": [
    {
      "risk": "exploit attempt",
      "input": "' OR 1=1--",
      "score": 60
    },
    {
      "risk": "exploit attempt",
      "input": "<script>alert(1)</script>",
      "score": 100
    },
    {
      "risk": "safe",
      "input": "safe text",
      "score": 0
    },
    {
      "risk": "exploit attempt",
      "input": "../../etc/passwd",
      "score": 80
    }
  ]
}

QUICK CURL

curl -X POST https://api.dakidarts.com/sqli-xss-detector/detect/batch -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"inputs": ["SELECT * FROM users"]}'

GROUP / 04

Payloads

Payloads endpoints sourced from the SQL Injection / XSS Payload Detector API implementation.

1 endpoint

GET /payloads Payloads SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Return embedded example payloads grouped by attack category. Great for testing the API or building lab environments.

8. Test Payload Database — `GET /payloads`

Return embedded example payloads grouped by attack category. Great for testing the API or building lab environments.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/payloads

Method: GET

Parameters

Name	Type	Required	Description	Example(s)
category	string	Optional	Filter to one category.	`xss`, `sqli`, `path_traversal`
limit	integer	Optional	Max payloads per category (default 100).	`3`

Example Request (GET)

curl "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/payloads?category=xss&limit=3" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY"

Example Response

{
  "count": 3,
  "limit": 3,
  "categories": {
    "xss": [
      "<script>alert(1)</script>",
      "<img src=x onerror=alert(1)>",
      "<svg/onload=alert(1)>"
    ]
  }
}

Available categories: sqli, xss, command_injection, path_traversal, nosql_injection, ssti, ldap_injection, formula_injection, crlf_injection, open_redirect.

Source contract imported from sql xss detection/app.py. Handler: payloads. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`category`	query	string	No	Optional payload category filter; omit to return all categories.
`limit`	query	integer	No	Maximum payloads returned per category (defaults to 100).

SAMPLE RESPONSE

{
  "count": 3,
  "limit": 3,
  "categories": {
    "xss": [
      "<script>alert(1)</script>",
      "<img src=x onerror=alert(1)>",
      "<svg/onload=alert(1)>"
    ]
  }
}

QUICK CURL

curl -X GET 'https://api.dakidarts.com/sqli-xss-detector/payloads?limit=100' -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

GROUP / 05

Utilities

Utilities endpoints sourced from the SQL Injection / XSS Payload Detector API implementation.

4 endpoints

GET /utilities/encode Encode Util SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Encode any text into Base64, URL-encoded, hex, and/or unicode-escape forms. Useful for building obfuscated test payloads.

9. Encode Text — `POST /utilities/encode` / `GET /utilities/encode`

Encode any text into Base64, URL-encoded, hex, and/or unicode-escape forms. Useful for building obfuscated test payloads.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/utilities/encode

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	Text to encode. Max 10,000 chars.	`hello`, `' OR 1=1--`
encodings	array	Optional	Encodings to apply. Defaults to all four.	`["base64"]`, `["base64","url","hex","unicode"]`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/utilities/encode" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"input": "hello", "encodings": ["base64", "url", "hex", "unicode"]}'

Example Response

{
  "input": "hello",
  "encodings": {
    "base64": "aGVsbG8=",
    "url": "hello",
    "hex": "0x68656c6c6f",
    "unicode": "\\u0068\\u0065\\u006c\\u006c\\u006f"
  }
}

Source contract imported from sql xss detection/app.py. Handler: encode_util. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`input`	query	string	Yes	Text to encode (maximum 10,000 characters).

RESPONSE SHAPE / NO VERIFIED SAMPLE

{
  "type": "object",
  "properties": {
    "input": {
      "description": "Dynamic source value; no concrete response example is published."
    },
    "encodings": {
      "type": "object",
      "additionalProperties": true
    }
  },
  "additionalProperties": true
}

QUICK CURL

curl -X GET https://api.dakidarts.com/sqli-xss-detector/utilities/encode -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /utilities/encode Encode Util SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Encode any text into Base64, URL-encoded, hex, and/or unicode-escape forms. Useful for building obfuscated test payloads.

9. Encode Text — `POST /utilities/encode` / `GET /utilities/encode`

Encode any text into Base64, URL-encoded, hex, and/or unicode-escape forms. Useful for building obfuscated test payloads.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/utilities/encode

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	Text to encode. Max 10,000 chars.	`hello`, `' OR 1=1--`
encodings	array	Optional	Encodings to apply. Defaults to all four.	`["base64"]`, `["base64","url","hex","unicode"]`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/utilities/encode" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"input": "hello", "encodings": ["base64", "url", "hex", "unicode"]}'

Example Response

{
  "input": "hello",
  "encodings": {
    "base64": "aGVsbG8=",
    "url": "hello",
    "hex": "0x68656c6c6f",
    "unicode": "\\u0068\\u0065\\u006c\\u006c\\u006f"
  }
}

Source contract imported from sql xss detection/app.py. Handler: encode_util. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`input`	body	string	Yes	Text to encode (maximum 10,000 characters). POST also accepts form data.
`encodings`	body	array	No	Optional array drawn from `base64`, `url`, `hex`, and `unicode`; defaults to all four.

SAMPLE RESPONSE

{
  "input": "hello",
  "encodings": {
    "hex": "0x68656c6c6f",
    "url": "hello",
    "base64": "aGVsbG8=",
    "unicode": "\\u0068\\u0065\\u006c\\u006c\\u006f"
  }
}

QUICK CURL

curl -X POST https://api.dakidarts.com/sqli-xss-detector/utilities/encode -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"input": "example", "encodings": ["base64", "url", "hex", "unicode"]}'

GET /utilities/decode Decode Util SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Automatically decode obfuscated input. Iteratively applies URL, HTML-entity, unicode-escape, hex, and Base64 decoders (up to 6 layers) and reports which encodings were detected.

10. Decode Text — `POST /utilities/decode` / `GET /utilities/decode`

Automatically decode obfuscated input. Iteratively applies URL, HTML-entity, unicode-escape, hex, and Base64 decoders (up to 6 layers) and reports which encodings were detected.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/utilities/decode

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	Encoded string to decode. Max 10,000 chars.	`%3Cscript%3Ealert(1)%3C%2Fscript%3E`, `aGVsbG8=`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/utilities/decode" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"input": "aGVsbG8="}'

Example Response

{
  "input": "aGVsbG8=",
  "decoded": "hello",
  "encoding_layers": ["base64"],
  "was_obfuscated": true
}

Source contract imported from sql xss detection/app.py. Handler: decode_util. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`input`	query	string	Yes	Encoded string to decode (maximum 10,000 characters).

RESPONSE SHAPE / NO VERIFIED SAMPLE

{
  "type": "object",
  "properties": {
    "input": {
      "description": "Dynamic source value; no concrete response example is published."
    },
    "decoded": {
      "description": "Dynamic source value; no concrete response example is published."
    },
    "was_obfuscated": {
      "description": "Dynamic source value; no concrete response example is published."
    },
    "encoding_layers": {
      "description": "Dynamic source value; no concrete response example is published."
    }
  },
  "additionalProperties": true
}

QUICK CURL

curl -X GET https://api.dakidarts.com/sqli-xss-detector/utilities/decode -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /utilities/decode Decode Util SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Automatically decode obfuscated input. Iteratively applies URL, HTML-entity, unicode-escape, hex, and Base64 decoders (up to 6 layers) and reports which encodings were detected.

10. Decode Text — `POST /utilities/decode` / `GET /utilities/decode`

Automatically decode obfuscated input. Iteratively applies URL, HTML-entity, unicode-escape, hex, and Base64 decoders (up to 6 layers) and reports which encodings were detected.

Full URL:

https://sql-injection-xss-payload-detector-api.p.rapidapi.com/utilities/decode

Method: POST (also GET) Content-Type: application/json

Parameters

Name	Type	Required	Description	Example(s)
input	string	Yes	Encoded string to decode. Max 10,000 chars.	`%3Cscript%3Ealert(1)%3C%2Fscript%3E`, `aGVsbG8=`

Example Request (POST)

curl -X POST "https://sql-injection-xss-payload-detector-api.p.rapidapi.com/utilities/decode" \
-H "Content-Type: application/json" \
-H "x-rapidapi-host: sql-injection-xss-payload-detector-api.p.rapidapi.com" \
-H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
-d '{"input": "aGVsbG8="}'

Example Response

{
  "input": "aGVsbG8=",
  "decoded": "hello",
  "encoding_layers": ["base64"],
  "was_obfuscated": true
}

Source contract imported from sql xss detection/app.py. Handler: decode_util. Reference: RAPID_README.md.

PARAMETERS

Name	In	Type	Required	Description
`input`	body	string	Yes	Encoded string to decode (maximum 10,000 characters). POST also accepts form data.

SAMPLE RESPONSE

{
  "input": "aGVsbG8=",
  "decoded": "hello",
  "was_obfuscated": true,
  "encoding_layers": [
    "base64"
  ]
}

QUICK CURL

curl -X POST https://api.dakidarts.com/sqli-xss-detector/utilities/decode -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"input": "example"}'

INTERACTIVE SANDBOX

Explore a response before you integrate.

Edit a JSON request to validate its syntax and preview the published sample response. This stays in your browser; it never calls the live API or uses credits.

The preview checks JSON syntax and shows the saved example response; it does not execute request values.

MOCK RESPONSE

TYPESCRIPT CONTRACT

INTEGRATION SDK

Use the product where it lives.

These are integration templates, not runnable sample calls. Configure an endpoint upstream in API Studio, then replace the placeholder path. Saved samples stay preview-only.

REST/JSON

# Replace with a connected GET route and include any required parameters.
curl -X GET "https://api.dakidarts.com/sqli-xss-detector/v1/your-connected-endpoint" \
  -H "X-API-Key: dk_live_..." \
  -H "Accept: application/json"

# Replace with a connected GET route and include any required parameters.
import requests

headers = {"X-API-Key": "dk_live_..."}
response = requests.get("https://api.dakidarts.com/sqli-xss-detector/v1/your-connected-endpoint", headers=headers)
print(response.json())

// Replace with a connected GET route and include any required parameters.
const res = await fetch("https://api.dakidarts.com/sqli-xss-detector/v1/your-connected-endpoint", {
  headers: { "X-API-Key": "dk_live_..." }
});
const data = await res.json();
console.log(data);

<?php
// Replace with a connected GET route and include any required parameters.
$ch = curl_init("https://api.dakidarts.com/sqli-xss-detector/v1/your-connected-endpoint");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["X-API-Key: dk_live_..."]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
$data = json_decode($response, true);

Explore more Security and adjacent APIs.

Full catalog

SQL Injection / XSS Payload Detector API

Call SQL Injection / XSS Payload Detector API through the Dakidarts gateway.

One key, one gateway

Metered by the call

Observable by default

Also available through RapidAPI.

Built to disappear into the product.

Add a detection layer to forms and gateways

Support WAF-style inspection workflows

Return machine-readable security signals

The shape of the surface.

Answers before you integrate.

Choose a quota that matches the workload.

Pay-as-you-go access

From first request to production.

Create a Dakidarts key

Call the gateway

Watch usage

Endpoint reference & metered costs.

Operations

GET /

GET /status

GET /meta

Analysis

1. Detect Payload — POST /detect / GET /detect

Parameters

Example Request (POST)

Example Response

GET Request Example

1. Detect Payload — POST /detect / GET /detect

Parameters

Example Request (POST)

Example Response

GET Request Example

2. Detect SQL Injection — POST /detect/sqli / GET /detect/sqli

Parameters

Example Request (POST)

Example Response

2. Detect SQL Injection — POST /detect/sqli / GET /detect/sqli

Parameters

Example Request (POST)

Example Response

3. Detect XSS — POST /detect/xss / GET /detect/xss

Parameters

Example Request (GET)

Example Response

3. Detect XSS — POST /detect/xss / GET /detect/xss

Parameters

Example Request (GET)

Example Response

5. Deep Analysis — POST /analyze / GET /analyze

Parameters

Example Request (POST)

Example Response

5. Deep Analysis — POST /analyze / GET /analyze

Parameters

Example Request (POST)

Example Response

6. Analyze URL (BYOK) — POST /analyze/url / GET /analyze/url

Parameters

Example Request (POST)

Example Response

6. Analyze URL (BYOK) — POST /analyze/url / GET /analyze/url

Parameters

Example Request (POST)

Example Response

7. HTTP Security Header Audit — POST /scan/headers / GET /scan/headers

Parameters

Example Request (POST)

Example Response

7. HTTP Security Header Audit — POST /scan/headers / GET /scan/headers

Parameters

Example Request (POST)

Example Response

Batch operations

4. Batch Detect — POST /detect/batch / GET /detect/batch

Parameters

Example Request (POST)

Example Response

4. Batch Detect — POST /detect/batch / GET /detect/batch

`GET /`

`GET /status`

`GET /meta`

1. Detect Payload — `POST /detect` / `GET /detect`

1. Detect Payload — `POST /detect` / `GET /detect`

2. Detect SQL Injection — `POST /detect/sqli` / `GET /detect/sqli`

2. Detect SQL Injection — `POST /detect/sqli` / `GET /detect/sqli`

3. Detect XSS — `POST /detect/xss` / `GET /detect/xss`

3. Detect XSS — `POST /detect/xss` / `GET /detect/xss`

5. Deep Analysis — `POST /analyze` / `GET /analyze`

5. Deep Analysis — `POST /analyze` / `GET /analyze`

6. Analyze URL (BYOK) — `POST /analyze/url` / `GET /analyze/url`

6. Analyze URL (BYOK) — `POST /analyze/url` / `GET /analyze/url`

7. HTTP Security Header Audit — `POST /scan/headers` / `GET /scan/headers`

7. HTTP Security Header Audit — `POST /scan/headers` / `GET /scan/headers`

4. Batch Detect — `POST /detect/batch` / `GET /detect/batch`

4. Batch Detect — `POST /detect/batch` / `GET /detect/batch`

8. Test Payload Database — `GET /payloads`

9. Encode Text — `POST /utilities/encode` / `GET /utilities/encode`

9. Encode Text — `POST /utilities/encode` / `GET /utilities/encode`

10. Decode Text — `POST /utilities/decode` / `GET /utilities/decode`

10. Decode Text — `POST /utilities/decode` / `GET /utilities/decode`