diff options
Diffstat (limited to 'examples-secure/xss')
| -rw-r--r-- | examples-secure/xss/comments.db | bin | 0 -> 8192 bytes | |||
| -rw-r--r-- | examples-secure/xss/index.php | 36 |
2 files changed, 36 insertions, 0 deletions
diff --git a/examples-secure/xss/comments.db b/examples-secure/xss/comments.db Binary files differnew file mode 100644 index 0000000..959a2c8 --- /dev/null +++ b/examples-secure/xss/comments.db diff --git a/examples-secure/xss/index.php b/examples-secure/xss/index.php new file mode 100644 index 0000000..7bc3d45 --- /dev/null +++ b/examples-secure/xss/index.php @@ -0,0 +1,36 @@ +<?php + class MyDB extends SQLite3 { + function __construct() { + $this->open('comments.db'); + } + } + + if (isset($_POST['user'], $_POST['comment'])) { + $user = $_POST['user']; + $comment = $_POST['comment']; + + $db = new MyDB(); + + $sql = 'INSERT INTO Comments VALUES(\'' . $user . '\',\'' . $comment . '\')'; + $ret = $db->exec($sql); + $db->close(); + } + + echo '<!DOCTYPE HTML>< |