Database System Concepts
Database System Concepts
7th Edition
ISBN: 9780078022159
Author: Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher: McGraw-Hill Education
Bartleby Related Questions Icon

Related questions

bartleby

Concept explainers

Question
9) Consider the following (amateur) PHP script for a login page:
$username = $_GET[user] ;
$password = $_GET[pwd];
$sql = "SELECT * FROM usertable
WHERE username = '$username' AND password =
$result = $db-query($sql);
if ($result->num rows > 0) { /* Success */ }
else { /* Failure
}
www
'$password'
a. Give a value that an attacker can enter in the field called user that will result in a successful
login. Assume the attacker does not know any usernames or passwords for the site.
|
10) Suppose a website a.com hosts the following PHP script called go.php:
<HTML> <TITLE> Go forth </TITLE>
<BODY>
php echo $_GET[p] ?> :
</BODY> </HTML>
Suppose an attacker wishes to send an email with a link that will reflect the recipient's cookie from
a.com back to the attacker. Write a URL that the attacker could include, specifying, which website, if
any, the attacker should control.
Note: do not worry about getting the URL encoding right - use a human-readable representation.
expand button
Transcribed Image Text:9) Consider the following (amateur) PHP script for a login page: $username = $_GET[user] ; $password = $_GET[pwd]; $sql = "SELECT * FROM usertable WHERE username = '$username' AND password = $result = $db-query($sql); if ($result->num rows > 0) { /* Success */ } else { /* Failure } www '$password' a. Give a value that an attacker can enter in the field called user that will result in a successful login. Assume the attacker does not know any usernames or passwords for the site. | 10) Suppose a website a.com hosts the following PHP script called go.php: <HTML> <TITLE> Go forth </TITLE> <BODY> php echo $_GET[p] ?> : </BODY> </HTML> Suppose an attacker wishes to send an email with a link that will reflect the recipient's cookie from a.com back to the attacker. Write a URL that the attacker could include, specifying, which website, if any, the attacker should control. Note: do not worry about getting the URL encoding right - use a human-readable representation.
Expert Solution
Check Mark
Knowledge Booster
Background pattern image
Computer Science
Learn more about
Need a deep-dive on the concept behind this application? Look no further. Learn more about this topic, computer-science and related others by exploring similar questions and additional content below.
Similar questions
Recommended textbooks for you
Text book image
Database System Concepts
Computer Science
ISBN:9780078022159
Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher:McGraw-Hill Education
Text book image
Starting Out with Python (4th Edition)
Computer Science
ISBN:9780134444321
Author:Tony Gaddis
Publisher:PEARSON
Text book image
Digital Fundamentals (11th Edition)
Computer Science
ISBN:9780132737968
Author:Thomas L. Floyd
Publisher:PEARSON
Text book image
C How to Program (8th Edition)
Computer Science
ISBN:9780133976892
Author:Paul J. Deitel, Harvey Deitel
Publisher:PEARSON
Text book image
Database Systems: Design, Implementation, & Manag...
Computer Science
ISBN:9781337627900
Author:Carlos Coronel, Steven Morris
Publisher:Cengage Learning
Text book image
Programmable Logic Controllers
Computer Science
ISBN:9780073373843
Author:Frank D. Petruzella
Publisher:McGraw-Hill Education