Sql-injection-unsafe-php - Versionsgeschichte

Thomas.will am 1. März 2024 um 11:14 Uhr

2024-03-01T11:14:29Z

Thomas.will am 11. September 2023 um 11:31 Uhr

2023-09-11T11:31:15Z

Thomas.will am 11. September 2023 um 11:30 Uhr

2023-09-11T11:30:53Z

Thomas.will am 10. Oktober 2020 um 12:00 Uhr

2020-10-10T12:00:10Z

Thomas.will: Die Seite wurde neu angelegt: „

 
2020-10-07T16:59:56Z
Die Seite wurde neu angelegt: „ <pre> <?php   if(isset($_POST['submit'])){     //connect db     include "inc/connect.php";     //unsafe query     $search = $_POST['search'];     //Database s…“
Neue Seite


<pre>

<?php

  if(isset($_POST['submit'])){

    //connect db

    include "inc/connect.php";

    //unsafe query

    $search = $_POST['search'];

    //Database search

    $sql = "SELECT * FROM users WHERE username='$search'";

    $result = mysqli_query($link, $sql);

  }

?>



<!DOCTYPE html>

<html>

        <body>

                <h2>SQL Injection</h2>

                <form method="post">

                  <label for="fname">Suche</label><br>

                  <input type="text" name="search"><br>

                  <input type="submit" name="submit" value="Suche">

                </form> 

                <br>

                <table border = "1">

                        <tr>

                                <td>ID</td>

                                <td>Name</td>

                                <td>Passwort</td>

                        </tr>

<?php

  while ($row = mysqli_fetch_row($result)) {

    echo "<tr>";

    echo "<td>".$row[0]." </td>";

    echo "<td>".$row[1]." </td>";

    echo "<td>".$row[2]." </td><br>";

    echo "</tr>";

  }

?>

                </table>

        </body>

</html>

</pre>

@@ Zeile 6: / Zeile 6: @@
      define('DB_USERNAME', 'xinux');
      define('DB_PASSWORD', 'suxer');
-     define('DB_NAME', 'sql_injections');
+     define('DB_NAME', 'verwaltung');
      $link = mysqli_connect(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);
      mysqli_set_charset($link, "utf8");