Hello this question is related to Web Technologies Please, don\'t answer with yo
ID: 3701306 • Letter: H
Question
Hello this question is related to Web Technologies
Please, don't answer with your handwriting
Thank you
You have the following two tables in a MySQL database called it230 order statuses userS PK int(11) varchar(30) PK user name varchar(32) statuS You also have the following track.php page that allows a user to enter an order number and then connects to the database to return the status of that order chtml> body> Please enter your order number to track the status of your order: nput ?nput type-"text" names "order-number" > type="submit" value-"Track">Explanation / Answer
1. List of user name and passwords for all the users would be returned and displayed to the adversary.
2. This type of attack is called as SQL injection
3. We can use prepared statements method to prevent this very easily. This would go as follows
Track.php
<html>
<body>
<form action="track.php" method="post">
Please enter your order number to track the status of your order:
<input type="text" name="order_number"><br/>
<input type="submit" value="Track">
</form>
</body>
</html>
<?php
if(isset($_POST["order_number"]))
{
$conn = mysqli_connect("localhost", "root", "", "it230");
$st = $conn->prepare("SELECT status FROM order_statuses WHERE order_number = ?");
// bind the order number as an integer
$st->bind_param('i', $_POST["order_number"]);
$st->execute();
$result = $st->get_result();
if(mysqli_num_rows($result) > 0){
$row = mysqli_fetch_assoc($result);
echo "Your order is: ".$row["status"];
} else {
echo "We apologize, your order was not found";
}
mysqli_close($conn);
}
?>
Related Questions
drjack9650@gmail.com
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.