
Database System Concepts
7th Edition
ISBN: 9780078022159
Author: Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher: McGraw-Hill Education
expand_more
expand_more
format_list_bulleted
Concept explainers
Question
![9) Consider the following (amateur) PHP script for a login page:
$username = $_GET[user] ;
$password = $_GET[pwd];
$sql = "SELECT * FROM usertable
WHERE username = '$username' AND password =
$result = $db-query($sql);
if ($result->num rows > 0) { /* Success */ }
else { /* Failure
}
www
'$password'
a. Give a value that an attacker can enter in the field called user that will result in a successful
login. Assume the attacker does not know any usernames or passwords for the site.
|
10) Suppose a website a.com hosts the following PHP script called go.php:
<HTML> <TITLE> Go forth </TITLE>
<BODY>
php echo $_GET[p] ?> :
</BODY> </HTML>
Suppose an attacker wishes to send an email with a link that will reflect the recipient's cookie from
a.com back to the attacker. Write a URL that the attacker could include, specifying, which website, if
any, the attacker should control.
Note: do not worry about getting the URL encoding right - use a human-readable representation.](https://content.bartleby.com/qna-images/question/6924c7cd-8161-4ad3-9951-2eb18be8272b/8aee3b84-9b07-4077-b6c4-fecfc56656f1/q6eajw_thumbnail.jpeg)
Transcribed Image Text:9) Consider the following (amateur) PHP script for a login page:
$username = $_GET[user] ;
$password = $_GET[pwd];
$sql = "SELECT * FROM usertable
WHERE username = '$username' AND password =
$result = $db-query($sql);
if ($result->num rows > 0) { /* Success */ }
else { /* Failure
}
www
'$password'
a. Give a value that an attacker can enter in the field called user that will result in a successful
login. Assume the attacker does not know any usernames or passwords for the site.
|
10) Suppose a website a.com hosts the following PHP script called go.php:
<HTML> <TITLE> Go forth </TITLE>
<BODY>
php echo $_GET[p] ?> :
</BODY> </HTML>
Suppose an attacker wishes to send an email with a link that will reflect the recipient's cookie from
a.com back to the attacker. Write a URL that the attacker could include, specifying, which website, if
any, the attacker should control.
Note: do not worry about getting the URL encoding right - use a human-readable representation.
Expert Solution

This question has been solved!
Explore an expertly crafted, step-by-step solution for a thorough understanding of key concepts.
Step by stepSolved in 3 steps

Knowledge Booster
Learn more about
Need a deep-dive on the concept behind this application? Look no further. Learn more about this topic, computer-science and related others by exploring similar questions and additional content below.Similar questions
- Create a MySQL stored procedure to validate an attempt to create a new submission. The stored procedure should have parameters for the user, the user’s password, the id of the problem, the programming language (as a varchar), and the source code. An output parameter returns the result of the submission, which is one of the strings that can return or “Bad Parameters”, which handles cases such as incorrect password for the user, or the attempt to submit using a language that the program does not support (e.g., Malbolge or Visual Basic). The stored procedure can simulate the program judging process: if there is no Bad Parameters error, then randomly choose between Accepted, Wrong Answer, Time Limit Exceeded, and Run Time Error with equal probability. The submission should gets recorded in the database.arrow_forwardI am having an issue creating this function with a trigger using postgreSQL (plpgsql). Could someone please help me solve this? Thank you! CREATE OR REPLACE FUNCTION Moreno_03_bankTriggerFunction()RETURNS TRIGGERLANGUAGE PLPGSQLAS$$BEGINCREATE TRIGGER Moreno_03_bankTriggerAFTER DELETE ON accountFOR EACH ROWWHERE depositor.account_number = account.account_numberEXECUTE PROCEDURE Moreno_15_bankTriggerFunction();END;$$ Database Schema: branch ( branch_name, branch_city, assets ) customer ( ID, customer_name, customer_street, customer_city ) loan ( loan_number, branch_name, amount ) borrower ( ID, loan_number ) account ( account_number, branch_name, balance ) depositor ( ID, account_number )arrow_forwardq20- Choose ALL that apply.arrow_forward
arrow_back_ios
arrow_forward_ios
Recommended textbooks for you
- Database System ConceptsComputer ScienceISBN:9780078022159Author:Abraham Silberschatz Professor, Henry F. Korth, S. SudarshanPublisher:McGraw-Hill EducationStarting Out with Python (4th Edition)Computer ScienceISBN:9780134444321Author:Tony GaddisPublisher:PEARSONDigital Fundamentals (11th Edition)Computer ScienceISBN:9780132737968Author:Thomas L. FloydPublisher:PEARSON
- C How to Program (8th Edition)Computer ScienceISBN:9780133976892Author:Paul J. Deitel, Harvey DeitelPublisher:PEARSONDatabase Systems: Design, Implementation, & Manag...Computer ScienceISBN:9781337627900Author:Carlos Coronel, Steven MorrisPublisher:Cengage LearningProgrammable Logic ControllersComputer ScienceISBN:9780073373843Author:Frank D. PetruzellaPublisher:McGraw-Hill Education

Database System Concepts
Computer Science
ISBN:9780078022159
Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher:McGraw-Hill Education

Starting Out with Python (4th Edition)
Computer Science
ISBN:9780134444321
Author:Tony Gaddis
Publisher:PEARSON

Digital Fundamentals (11th Edition)
Computer Science
ISBN:9780132737968
Author:Thomas L. Floyd
Publisher:PEARSON

C How to Program (8th Edition)
Computer Science
ISBN:9780133976892
Author:Paul J. Deitel, Harvey Deitel
Publisher:PEARSON

Database Systems: Design, Implementation, & Manag...
Computer Science
ISBN:9781337627900
Author:Carlos Coronel, Steven Morris
Publisher:Cengage Learning

Programmable Logic Controllers
Computer Science
ISBN:9780073373843
Author:Frank D. Petruzella
Publisher:McGraw-Hill Education