From b0cf064f819357feedc77d6d5eb0de49e122554a Mon Sep 17 00:00:00 2001
From: marcinzelent <zelent.marcin@gmail.com>
Date: Sat, 16 Jun 2018 22:50:18 +0200
Subject: Added command injection example and secured examples

---
 examples-secure/sql-injection/login.php | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 examples-secure/sql-injection/login.php

(limited to 'examples-secure/sql-injection/login.php')

diff --git a/examples-secure/sql-injection/login.php b/examples-secure/sql-injection/login.php
new file mode 100644
index 0000000..f0340e3
--- /dev/null
+++ b/examples-secure/sql-injection/login.php
@@ -0,0 +1,25 @@
+<?php
+   class MyDB extends SQLite3 {
+      function __construct() {
+         $this->open('users.db');
+      }
+   }
+
+   if(isset($_POST['email'], $_POST['pass']))
+   {
+	$email = $_POST['email'];
+	$pass = $_POST['pass'];
+
+	$db = new MyDB();
+
+	$sql = $db->prepare('SELECT * FROM Users WHERE email=:email AND password=:pass');
+	$sql->bindValue(':email', $email, SQLITE3_TEXT);
+	$sql->bindValue(':pass', $pass, SQLITE3_TEXT);
+
+	$ret = $sql->execute();
+	while($row = $ret->fetchArray(SQLITE3_ASSOC)) {
+		echo 'Logged in as '.$row['email'].'<br>';
+	}
+	$db->close();
+   }
+?>
-- 
cgit v1.2.3