From 7b2e079f4ef3cd3f16c6c5ca30fc3e97fd982b28 Mon Sep 17 00:00:00 2001 From: Marcin Zelent Date: Wed, 30 May 2018 17:56:40 +0200 Subject: Added XSS example --- xss/comments.db | Bin 0 -> 8192 bytes xss/index.php | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 36 insertions(+) create mode 100644 xss/comments.db create mode 100644 xss/index.php (limited to 'xss') diff --git a/xss/comments.db b/xss/comments.db new file mode 100644 index 0000000..32114c2 Binary files /dev/null and b/xss/comments.db differ diff --git a/xss/index.php b/xss/index.php new file mode 100644 index 0000000..e645517 --- /dev/null +++ b/xss/index.php @@ -0,0 +1,36 @@ +open('comments.db'); + } + } + + if (isset($_POST['user'], $_POST['comment'])) { + $user = $_POST['user']; + $comment = $_POST['comment']; + + $db = new MyDB(); + + $sql = 'INSERT INTO Comments VALUES(\'' . $user . '\',\'' . $comment . '\')'; + $ret = $db->exec($sql); + $db->close(); + } + + echo 'Comments' . + '

Comments

'; + + $db = new MyDB(); + + $sql = 'SELECT * FROM Comments'; + $ret = $db->query($sql); + while ($row = $ret->fetchArray(SQLITE3_ASSOC)) + echo '

' . $row['user'] . ' says:
' . $row['comment'] . '

'; + + $db->close(); + + echo '

Add comment

'; +?> -- cgit v1.2.3