Content coming soon.
", "summary": "零基础单元测试入门教程，覆盖 Python/pytest 实战，AAA 模式、Mock、Fixture 核心概念一网打尽。", "date_published": "2026-05-20", "date_modified": "2026-05-20", "tags": [ "单元测试", "Python", "测试" ] }, { "id": "https://aidev.fit/en/tech/regex-guide.html", "url": "https://aidev.fit/en/tech/regex-guide.html", "title": "正则表达式 30 分钟入门指南", "content_text": "Content coming soon.", "content_html": "Content coming soon.
", "summary": "从完全不懂到能写出实用的正则表达式，涵盖元字符、量词、分组、断言和 Python/JS 实战示例。", "date_published": "2026-05-20", "date_modified": "2026-05-20", "tags": [ "正则表达式", "编程", "教程" ] }, { "id": "https://aidev.fit/en/tech/python-tutorial.html", "url": "https://aidev.fit/en/tech/python-tutorial.html", "title": "Python 入门教程：从零到写出第一个程序", "content_text": "Python Tutorial: From Zero to Your First Program Python is the most approachable programming language in the world — and also one of the most powerful. In this tutorial, you'll go from zero to a working program in 30 minutes. Installing Python Download from python.org . During installation on Windows, check \"Add Python to PATH\" . On macOS, brew install python works too. Verify with: python3 --version # should print "Python 3.x.x" Your First Program print("Hello, world!") Save as hello.py and run with python3 hello.py . That's it — you're a programmer now. Variables and Types name = "Alice" # string age = 30 # integer height = 1.68 # float is_student = False # boolean print(f"{name} is {age} years old") # f-strings! Conditionals score = 85 if score >= 90 : print ( "A" ) elif score >= 80 : print ( "B" ) elif score >= 70 : print ( "C" ) else : print ( "Need improvement" ) Lists and Loops fruits = ["apple", "banana", "cherry"] fruits.append("date") print(fruits[0]) # "apple" for fruit in fruits: print(fruit.upper()) # List comprehension (Python's superpower) squares = [x**2 for x in range(10)] # → [0, 1, 4, 9, 16, 25, 36, 49, 64, 81] Dictionaries user = { "name" : "Alice" , "email" : "alice@example.com" , "age" : 30 } print ( user [ "name" ]) user [ "city" ] = "New York" # add a key for key , value in user . items (): print ( f "{key}: {value}" ) Functions def greet ( name , greeting = "Hello" ) : return f "{greeting}, {name}!" print ( greet ( "Alice" )) # "Hello, Alice!" print ( greet ( "Bob" , "Howdy" )) # "Howdy, Bob!" Working with Files # Read a file with open("data.txt", "r") as f: content = f.read() # Write a file with open("output.txt", "w") as f: f.write("Hello, file!") Error Handling try: result = 10 / 0 except ZeroDivisionError: print("Can't divide by zero!") finally: print("This always runs") A Complete Mini-Program import json def load_todos (): try : with open ( "todos.json" ) as f : return json . load ( f ) except FileNotFoundError : return [] def save_todos ( todos ): with open ( "todos.json" , "w" ) as f : json . dump ( todos , f , indent = 2 ) def main (): todos = load_todos () while True : cmd = input ( "add/show/quit: " ) . lower () if cmd == "add" : todos . append ( input ( "Task: " )) save_todos ( todos ) elif cmd == "show" : for i , t in enumerate ( todos , 1 ): print ( f " { i } . { t } " ) elif cmd == "quit" : break main () Where to Go Next Automate the Boring Stuff — free Python book, perfect for practical learners Real Python — excellent tutorials from beginner to advanced Build something — a CLI tool, a simple web scraper, a TODO app. Anything. The secret to learning Python: start building things immediately. Don't get stuck in tutorial hell. See also: Nginx Configuration Guide , Terraform Infrastructure as Code , API Gateway Implementation Guide", "content_html": "Python is the most approachable programming language in the world — and also one of the most powerful. In this tutorial, you'll go from zero to a working program in 30 minutes.
\nDownload from python.org. During installation on Windows, check \"Add Python to PATH\". On macOS, brew install python works too. Verify with:
python3 --version # should print "Python 3.x.x"\nprint("Hello, world!")\nSave as hello.py and run with python3 hello.py. That's it — you're a programmer now.
name = "Alice" # string\nage = 30 # integer\nheight = 1.68 # float\nis_student = False # boolean\n\nprint(f"{name} is {age} years old") # f-strings!\nscore = 85\nif score >= 90:\n print("A")\nelif score >= 80:\n print("B")\nelif score >= 70:\n print("C")\nelse:\n print("Need improvement")\nfruits = ["apple", "banana", "cherry"]\nfruits.append("date")\nprint(fruits[0]) # "apple"\n\nfor fruit in fruits:\n print(fruit.upper())\n\n# List comprehension (Python's superpower)\nsquares = [x**2 for x in range(10)]\n# → [0, 1, 4, 9, 16, 25, 36, 49, 64, 81]\nuser = {\n "name": "Alice",\n "email": "alice@example.com",\n "age": 30\n}\nprint(user["name"])\nuser["city"] = "New York" # add a key\n\nfor key, value in user.items():\n print(f"{key}: {value}")\ndef greet(name, greeting="Hello"):\n return f"{greeting}, {name}!"\n\nprint(greet("Alice")) # "Hello, Alice!"\nprint(greet("Bob", "Howdy")) # "Howdy, Bob!"\n# Read a file\nwith open("data.txt", "r") as f:\n content = f.read()\n\n# Write a file\nwith open("output.txt", "w") as f:\n f.write("Hello, file!")\ntry:\n result = 10 / 0\nexcept ZeroDivisionError:\n print("Can't divide by zero!")\nfinally:\n print("This always runs")\nimport json\n\ndef load_todos():\n try:\n with open("todos.json") as f:\n return json.load(f)\n except FileNotFoundError:\n return []\n\ndef save_todos(todos):\n with open("todos.json", "w") as f:\n json.dump(todos, f, indent=2)\n\ndef main():\n todos = load_todos()\n while True:\n cmd = input("add/show/quit: ").lower()\n if cmd == "add":\n todos.append(input("Task: "))\n save_todos(todos)\n elif cmd == "show":\n for i, t in enumerate(todos, 1):\n print(f"{i}. {t}")\n elif cmd == "quit":\n break\n\nmain()\nThe secret to learning Python: start building things immediately. Don't get stuck in tutorial hell.
\nSee also: Nginx Configuration Guide, Terraform Infrastructure as Code, API Gateway Implementation Guide
", "summary": "零基础 Python 编程入门，30 分钟掌握变量、条件、循环、函数等核心语法，手写第一个可运行程序。", "date_published": "2026-05-20", "date_modified": "2026-05-20", "tags": [ "Python", "编程入门", "教程" ] }, { "id": "https://aidev.fit/en/tech/web-security-basics.html", "url": "https://aidev.fit/en/tech/web-security-basics.html", "title": "Web 安全入门：每个开发者都应知道的 10 个安全实践", "content_text": "Web Security Basics: CORS, CSP, XSS, CSRF — What Every Developer Must Know Security isn't optional — it's part of your job as a developer. Most breaches exploit well-known vulnerabilities that have been understood for years. Here are the five web security threats every developer must understand, with prevention strategies and code examples. The Threat Landscape Attack Severity OWASP Rank What It Does XSS (Cross-Site Scripting) Critical #2 Injects malicious scripts into your pages SQL Injection Critical #3 Executes arbitrary SQL on your database CSRF (Cross-Site Request Forgery) High Dropped Tricks users into performing unwanted actions CORS Misconfiguration High #5 Allows unauthorized cross-origin access Insecure Authentication Critical #1 Weak auth allows account takeover 1. Cross-Site Scripting (XSS) XSS happens when user input is rendered as HTML without sanitization. An attacker who can inject tags can steal cookies, session tokens, and sensitive data. // ❌ Vulnerable : div . innerHTML = userComment ; // Attacker : < img src = x onerror = "stealCookies()" > // ✅ Safe : div . textContent = userComment ; // Escapes HTML automatically // Or sanitize : import DOMPurify from 'dompurify' ; div . innerHTML = DOMPurify . sanitize ( userComment ); React note: JSX auto-escapes by default — you're safe from XSS in standard rendering. The danger is dangerouslySetInnerHTML and direct DOM manipulation. 2. SQL Injection Concatenating user input into SQL queries gives attackers full database access. Parameterized queries are the fix — use them 100% of the time. // ❌ Vulnerable — attacker input : "1; DROP TABLE users;" const query = ` SELECT * FROM users WHERE id = ${ userId }` ; // ✅ Safe — parameterized query const query = "SELECT * FROM users WHERE id = $1" ; const result = await db . query ( query , [ userId ] ); // ORM users : Prisma / Drizzle parameterize automatically 3. Cross-Site Request Forgery (CSRF) An attacker's site makes a request to your API using the victim's cookies. CSRF tokens ensure the request originated from your own frontend. // Mitigation strategies: // 1. SameSite cookies (simplest, best): Set - Cookie : session = abc123 ; SameSite = Strict ; HttpOnly ; Secure // 2. CSRF token (additional layer): // Server sends a unique token; client includes it in requests // Modern frameworks (Next.js, Remix) handle this automatically // 3. Custom header requirement: // Browsers don't allow custom headers cross-origin // Require X-Requested-With or similar 4. CORS Misconfiguration CORS (Cross-Origin Resource Sharing) controls which origins can access your API. The most common mistake: using a wildcard or reflecting the Origin header blindly. // ❌ Vulnerable — allows any origin : Access - Control - Allow - Origin : * Access - Control - Allow - Credentials : true // Can 't use with * // ❌ Vulnerable — reflects origin blindly : // If your server echoes back the request 's Origin header, any domain can access // ✅ Safe — explicit allowlist : const allowedOrigins = [ "https://myapp.com" , "https://admin.myapp.com" ]; const origin = req . headers . origin ; if ( allowedOrigins . includes ( origin )) { res . setHeader ( "Access-Control-Allow-Origin" , origin ); } 5. Content Security Policy (CSP) CSP is your last line of defense. It tells the browser what sources of scripts, styles, and other resources are allowed. A well-configured CSP makes XSS exploitation nearly impossible. // Recommended CSP header: Content - Security - Policy : default - src 'self' ; script - src 'self' 'unsafe-inline' 'unsafe-eval' https : //js.stripe.com; style - src 'self' 'unsafe-inline' ; img - src 'self' data : https :; font - src 'self' ; connect - src 'self' https : //api.myapp.com; frame - src https : //js.stripe.com; // NO 'unsafe-inline' for scripts in production (use nonce/hash) Security Checklist Authentication: Use OAuth 2.0 / OIDC. Never roll your own crypto. Passwords: bcrypt with cost factor 12+. Never store plaintext. HTTPS: Everywhere. Redirect HTTP. HSTS header. Dependencies: npm audit / snyk weekly. Auto-update minor patches. Environment variables: Never commit .env files. Inject at runtime. Rate limiting: Protect login and API endpoints from brute force. Logging: Log auth events. Never log passwords or tokens. Bottom line: Use parameterized queries, auto-escaping frameworks, SameSite cookies, CSP headers, and explicit CORS allowlists. Security is layers — implement them all, and a single failure won't compromise you. See also: REST API Best Practices and API Design Patterns . See also: API Design Patterns: Rate Limiting, Pagination, Idempotency, and More , Caching Strategies for Web Apps: CDN, Redis, Browser, and API Caching , WebSocket vs SSE vs Polling: Real-Time Data Patterns for Web Apps", "content_html": "Security isn't optional — it's part of your job as a developer. Most breaches exploit well-known vulnerabilities that have been understood for years. Here are the five web security threats every developer must understand, with prevention strategies and code examples.
\n| Attack | \nSeverity | \nOWASP Rank | \nWhat It Does | \n
|---|---|---|---|
| XSS (Cross-Site Scripting) | \nCritical | \n#2 | \nInjects malicious scripts into your pages | \n
| SQL Injection | \nCritical | \n#3 | \nExecutes arbitrary SQL on your database | \n
| CSRF (Cross-Site Request Forgery) | \nHigh | \nDropped | \nTricks users into performing unwanted actions | \n
| CORS Misconfiguration | \nHigh | \n#5 | \nAllows unauthorized cross-origin access | \n
| Insecure Authentication | \nCritical | \n#1 | \nWeak auth allows account takeover | \n
XSS happens when user input is rendered as HTML without sanitization. An attacker who can inject