Question

Question

engineering Computer-Science

Add a comment Improve this question Transcribed image text

Answer 1

Answer #1

1. present database dump will cometo web page.

2.SQL Injection.

3.To avoid the sql injection attack use the prepared statements instead of normal query.....find code snippet of track .php under below.....

<?php
if(isset($_POST["ordernumber"])){
$ordernumber = $_POST["ordernumber"];
$servername = "localhost";
$username = "root";
$password = "";
$dbname = "it230";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}

// prepare and bind
$stmt = $conn->prepare("SELECT status FROM order_statuses WHERE order_number=?");
$stmt->bind_param("s", $ordernumber);
$stmt->execute();
$result = $stmt->get_result();
if($result->num_rows === 0) {
echo "we apologize,your order was not found";
}
else{
$row = $result->fetch_assoc();
echo "your order is : ".$row['status'];
}

$stmt->close();
$conn->close();
?>

Add a comment

Answer 2

Homework Answers

Add Answer to:

Post as a guest

Earn Coins