{
"type": "email",
"seed": 42,
"count": 3,
"items": [
{
"value": "user@[192.168.1.1]",
"category": "ip_literal_domain",
"breaks": "Domain-parsing code that assumes the part after '@' is always a hostname (never a bracketed IP literal) fails to extract or validate the domain correctly.",
"safe_to_display": true
},
{
"value": "[email protected]",
"category": "punycode_domain",
"breaks": "The domain is punycode-encoded (an internationalized domain name). Domain allowlist or comparison logic that does not decode punycode may fail to recognize this as equivalent to its Unicode form, or fail to catch a homograph-spoofed lookalike domain encoded the same way.",
"safe_to_display": true
},
{
"value": "[email protected]",
"category": "plus_addressing",
"breaks": "Deduplication logic treating '[email protected]' and '[email protected]' as different accounts misses that most mail providers deliver both to the same inbox (sub-addressing, RFC 5233).",
"safe_to_display": true
}
]
}
curl --location --request GET 'https://zylalabs.com/api/13377/injection+test+string+generator+api/28556/generate+edge+case+test+data?type=email&count=3&seed=42' --header 'Authorization: Bearer YOUR_API_KEY'
{
"seed": 7,
"count": 2,
"rows": [
{
"user_email": {
"value": "a234567890123456789012345678901234567890123456789012345678901234@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.com",
"category": "max_length_254",
"breaks": "This address is near the RFC 5321 maximum length of 254 characters. Database columns sized below that maximum truncate or reject it even though it is technically valid.",
"safe_to_display": true
},
"signup_at": {
"value": "2026-11-01T01:30:00-04:00",
"category": "dst_fall_back_ambiguous",
"breaks": "In US Eastern time, this local clock time occurs twice during the fall-back transition. Without an explicit fold indicator, converting it to UTC is genuinely ambiguous, and libraries may silently pick the wrong occurrence.",
"safe_to_display": true
}
},
{
"user_email": {
"value": "[email protected]",
"category": "plus_addressing",
"breaks": "Deduplication logic treating '[email protected]' and '[email protected]' as different accounts misses that most mail providers deliver both to the same inbox (sub-addressing, RFC 5233).",
"safe_to_display": true
},
"signup_at": {
"value": "2026-01-01T24:00:00",
"category": "midnight_as_24_00",
"breaks": "ISO 8601 permits 24:00:00 to represent midnight at the end of a day, but many parsers only accept 00:00:00 through 23:59:59 and reject this equally valid representation.",
"safe_to_display": true
}
}
]
}
curl --location --request POST 'https://zylalabs.com/api/13377/injection+test+string+generator+api/28557/generate+multi-field+test+fixture+rows' --header 'Authorization: Bearer YOUR_API_KEY'
--data-raw '{
"fields": {
"user_email": "email",
"signup_at": "datetime"
},
"count": 2,
"seed": 7
}'
{
"types": [
{
"type": "date",
"category_group": "datetimes",
"description": "Calendar-boundary and invalid-looking-but-real dates.",
"categories": [
"earliest_iso_year",
"far_future_sentinel",
"invalid_day_of_month",
"leap_day",
"pre_epoch",
"year_2038"
],
"entry_count": 6
},
{
"type": "datetime",
"category_group": "datetimes",
"description": "Timestamps at DST transitions, unusual UTC offsets, and precision boundaries.",
"categories": [
"dst_fall_back_ambiguous",
"dst_spring_forward_gap",
"leap_second",
"midnight_as_24_00",
"quarter_hour_offset",
"sub_microsecond_precision"
],
"entry_count": 7
},
{
"type": "email",
"category_group": "emails",
"description": "RFC 5322-valid but unusual email addresses.",
"categories": [
"comment_syntax",
"ip_literal_domain",
"max_length_254",
"mixed_case",
"plus_addressing",
"punycode_domain",
"quoted_local_part"
],
"entry_count": 7
},
{
"type": "email_display_name",
"category_group": "emails",
"description": "Display-name strings that can corrupt naively-built SMTP headers.",
"categories": [
"angle_bracket_in_display_name",
"comma_in_display_name",
"crlf_header_injection",
"null_byte",
"very_long_display_name"
],
"entry_count": 5
},
{
"type": "emoji_sequence",
"category_group": "unicode",
"description": "Multi-codepoint emoji: ZWJ sequences, skin-tone modifiers, flag sequences, keycaps.",
"categories": [
"flag_sequence",
"keycap_sequence",
"skin_tone_modifier",
"zwj_family",
"zwj_generic_pair"
],
"entry_count": 5
},
{
"type": "float",
"category_group": "numbers",
"description": "Floating-point values that are not representable in JSON, or that expose IEEE 754 rounding.",
"categories": [
"denormal_minimum",
"ieee754_rounding",
"infinity",
"not_a_number",
"scientific_notation"
],
"entry_count": 5
},
{
"type": "integer",
"category_group": "numbers",
"description": "Integer values at 32-bit and 64-bit signed boundaries.",
"categories": [
"int32_max_plus_one",
"int32_min_minus_one",
"int64_max",
"leading_zeros",
"negative_zero"
],
"entry_count": 5
},
{
"type": "json_key",
"category_group": "structural",
"description": "Strings intended for use as a JSON object key, including reserved and unsafe names.",
"categories": [
"dollar_prefix",
"embedded_dot",
"empty_string_key",
"numeric_string_key",
"prototype_pollution_key",
"very_long_key",
"whitespace_only_key"
],
"entry_count": 8
},
{
"type": "json_value",
"category_group": "structural",
"description": "JSON values at precision, nesting, and null/empty/missing boundaries.",
"categories": [
"boolean_as_string",
"empty_array",
"empty_object",
"explicit_null",
"float64_precision_loss",
"leading_zero_numeric_string"
],
"entry_count": 6
},
{
"type": "organization_name",
"category_group": "names",
"description": "Company/brand names with punctuation, leading digits, or unusual casing.",
"categories": [
"accented_character",
"ampersand",
"apostrophe",
"intentional_lowercase_brand",
"leading_digit",
"trailing_punctuation",
"very_long_legal_name"
],
"entry_count": 7
},
{
"type": "path_or_filename",
"category_group": "identifiers",
"description": "Filenames and paths that are legal but mishandled by common filesystem or validation code.",
"categories": [
"bare_parent_reference",
"leading_dot_hidden_file",
"max_length_255",
"path_traversal",
"reserved_windows_device_name",
"trailing_dot",
"trailing_space",
"unicode_normalization_mismatch"
],
"entry_count": 8
},
{
"type": "person_name",
"category_group": "names",
"description": "Names that break naive validation, splitting, or templating logic -- includes canonical injection probes.",
"categories": [
"apostrophe",
"emoji_in_name",
"leading_trailing_whitespace",
"mononym",
"multi_word_particle_surname",
"reserved_word",
"right_to_left_script",
"shell_metacharacter_probe",
"single_character",
"sql_injection_probe",
"ssti_probe",
"very_long_name",
"xss_probe"
],
"entry_count": 14
},
{
"type": "phone_number",
"category_group": "addresses_phones",
"description": "Phone numbers at E.164 length boundaries and common formatting variants.",
"categories": [
"e164_maximum_length",
"e164_near_minimum_length",
"extension_suffix",
"human_formatted_punctuation",
"leading_zero_national_format",
"long_country_code"
],
"entry_count": 6
},
{
"type": "postal_code",
"category_group": "addresses_phones",
"description": "Postal codes from formats that break US-centric assumptions.",
"categories": [
"canada_alternating_pattern",
"country_without_postal_code",
"eircode",
"embedded_hyphen",
"leading_zero_us_zip",
"uk_postcode_variable_length"
],
"entry_count": 6
},
{
"type": "unicode_string",
"category_group": "unicode",
"description": "Strings with combining marks, bidi overrides, zero-width characters, and homoglyphs.",
"categories": [
"astral_plane",
"bidi_override",
"byte_order_mark",
"combining_diacritic",
"combining_mark_stack",
"homoglyph",
"mixed_script",
"variation_selector",
"zero_width_space"
],
"entry_count": 9
},
{
"type": "uuid",
"category_group": "identifiers",
"description": "Syntactically valid UUIDs at sentinel and formatting boundaries.",
"categories": [
"invalid_version_nibble",
"max_uuid",
"nil_uuid",
"unhyphenated_form",
"uppercase_hex"
],
"entry_count": 5
}
],
"formats": [
"csv",
"json",
"text"
],
"max_count": 500
}
curl --location --request GET 'https://zylalabs.com/api/13377/injection+test+string+generator+api/28558/list+available+types+and+categories' --header 'Authorization: Bearer YOUR_API_KEY'
注册后,每个开发者都会被分配一个个人 API 访问密钥,这是一个唯一的字母和数字组合,用于访问我们的 API 端点。要使用 Injection Test String Generator API 进行身份验证,只需在 Authorization 标头中包含您的 bearer token。
| 标头 | 描述 |
|---|---|
授权
|
必需
应为 Bearer access_key. 订阅后,请查看上方的"您的 API 访问密钥"。
|
无长期承诺。随时升级、降级或取消。 免费试用包括最多 50 个请求。
(年度计费可节省 2 个月 🎉)
领先企业的信赖之选
Edge case test data for QA and fuzz testing: Unicode, injection probes, boundary dates, float precision. 16 types, reproducible seeds, and every value explains what it breaks.
边界案例测试数据是技术上有效但位于软件常见故障边界的输入,例如闰年日期、32位限制的整数、包含撇号的名字、由多个码点组成的表情符号,以及Windows保留的文件名。普通的虚假数据生成器生成可信的数据;边界案例数据才是实际发现错误的。
Faker Mockaroo 和类似的工具优化生成看起来逼真的数据 —— 合理的姓名 地址 和日期 这个API则恰恰相反 每个值的选择都是因为它破坏了某些东西 它还会告诉你它破坏了什么 所以失败的测试可以立即诊断 而不是一个谜
以简单英语解释该值旨在揭示的特定失败模式——例如在IEEE 754算术中0.1 + 0.2的真实结果是0.30000000000000004,并且在与0.3的相等性检查中会失败。这将原始字符串转换为文档测试案例
是的 传递一个种子后 每次都会返回相同的值 永久有效 在/v1端点上 - 可以安全地固定到CI固定值中 如果省略种子 将随机生成一个并在响应中返回 这样您可以稍后重现该确切的运行
十六种类型分为八个组:Unicode字符串和表情符号序列,个人和组织名称,电子邮件和电子邮件显示名称,日期和日期时间,整数和浮点数,UUID和文件路径,邮政编码和电话号码,以及JSON键和值
是的 POST /v1/generate 接受一个字段对象将您自己的字段名称映射到类型,并返回多达500个完整行 每行最多20个字段 准备填充数据库或CI固定件
它包括标准安全测试指南中发布的规范性、无害的检测探针——一个SQL自同语,一个基本的XSS探针,一个路径遍历字符串。这些是用于测试您自己的输入处理的。没有有效的漏洞利用、shell有效负载或CVE特定攻击链
它区分了两种不同的风险。“假”意味着该值在用户界面中原始呈现是不安全的——例如,双向覆盖可能会视觉上伪装文件名。“真”意味着它可以安全地作为惰性文本显示,即使它仍然可能会破坏处理它的后端代码。如果你向用户显示生成的值,请对此进行过滤
是的 — 格式=csv,另外每行一个原始值的格式=text。默认情况下,会使触发电子表格公式执行的CSV单元格失效。如果您正在故意测试自己的CSV导入处理,请设置csv_escape=false。
不 这个API是无状态的没有数据库 你请求的任何内容以及为你生成的任何内容都不会被写入日志 只有请求元数据例如端点 状态码 以及请求的类型