Just stick it in a database Category
Assume that the table is called
clients
What SQL query would add a the user jharvard with password crimson and give him $1000 in cash?
INSERT INTO clients (username, password, cash) VALUES('jharvard','crimson', 1000)GET / HTTP/1.1 Host: thefacebook.com Connection: keep-alive Cache-Control: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Pragma: no-cache User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36 DNT: 1 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8,es;q=0.6 HTTP/1.1 301 Location: http://www.facebook.com/ Content-Type: text/html; charset=utf-8 X-FB-Debug: WuHbP8pJ8fpBFDwf2RrqaYvqBRhptxCvFNt5FlGPPaI= Date: Tue, 19 Nov 2013 20:20:40 GMT Connection: keep-alive Content-Length: 0
<form action="register.php" method="post">
<input name="username" placeholder="Username" type="text"/>
<input name="password" placeholder="Password" type="password"/>
<input name="confirmation" placeholder="Password (again)" type="password"/>
<button type="submit">Register</button>
</form>
$results = query("INSERT INTO users (username, hash, cash) VALUES(?, ?, 10000.0000)", _, _)$results = query("INSERT INTO users (username, hash, cash) VALUES(?, ?, 10000.0000)",
$_POST["username"], crypt($_POST["password"])<form action="http://section.cs50.net/section.php" method="get" name="section">
Name:
<input name="name" type="text" />
<br />
Comfort:
<input name="comfort" type="radio" value="more" /> More Comfortable
<input name="comfort" type="radio" value="less" /> Less Comfortable
<input name="comfort" type="radio" value="between" /> Somewhere in Between
<br />
<input type="submit" value="Section" />
</form>
UPDATE account SET balance = balance - 1000 WHERE number = 2; UPDATE account SET balance = balance + 1000 WHERE number = 1;This query is not atomic. Why is this bad code to run?
START TRANSACTION; UPDATE account SET balance = balance - 1000 WHERE number = 2; UPDATE account SET balance = balance + 1000 WHERE number = 1; COMMIT;
<form action="register.php" method="post" id="registration">
Email: <input id="email" name="email" type="text"/>
<br/>
Password: <input id="password" name="password" type="password"/>
<br/>
Password (again): <input id="confirmation" name="confirmation" type="password"/>
<br/><br/>
<input type="submit" value="Register"/>
</form>
$('#registration').submit(function() {
if ($('#email').val() == '' || $('#password').val() == '' || $('#confirmation').val() == '')
return false;
else if ($('#password').val() != $('#confirmation').val())
return false;
else
return true;
});
typedef struct node
{
int n;
struct node *left;
struct node *right;
}
node;
void unload(node *ptr)
{
void unload(node *ptr)
{
if (ptr == NULL)
return;
unload(ptr->left);
unload(ptr->right);
free(ptr);
}
$username = $_POST["username"];
$password = $_POST["password"];
query("SELECT * FROM users WHERE username='$username' AND password='$password';");
What happens which I type ' OR '1' = '1as my password? How can you prevent this?
query("SELECT * FROM users WHERE username=? AND password=?;" , $username, $password);void* foo(void* a, char b)
{
return &a[b];
}