'}),b.prototype=a.extend({},a.fn.tooltip.Constructor.prototype),b.prototype.constructor=b,b.prototype.getDefaults=function(){return b.DEFAULTS},b.prototype.setContent=function(){var a=this.tip(),b=this.getTitle(),c=this.getContent();a.find(".popover-title")[this.options.html?"html":"text"](b),a.find(".popover-content")[this.options.html?"string"==typeof c?"html":"append":"text"](c),a.removeClass("fade top bottom left right in"),a.find(".popover-title").html()||a.find(".popover-title").hide()},b.prototype.hasContent=function(){return this.getTitle()||this.getContent()},b.prototype.getContent=function(){var a=this.$element,b=this.options;return a.attr("data-content")||("function"==typeof b.content?b.content.call(a[0]):b.content)},b.prototype.arrow=function(){return this.$arrow=this.$arrow||this.tip().find(".arrow")},b.prototype.tip=function(){return this.$tip||(this.$tip=a(this.options.template)),this.$tip};var c=a.fn.popover;a.fn.popover=function(c){return this.each(function(){var d=a(this),e=d.data("bs.popover"),f="object"==typeof c&&c;(e||"destroy"!=c)&&(e||d.data("bs.popover",e=new b(this,f)),"string"==typeof c&&e[c]())})},a.fn.popover.Constructor=b,a.fn.popover.noConflict=function(){return a.fn.popover=c,this}}(jQuery),+function(a){"use strict";function b(c,d){var e,f=a.proxy(this.process,this);this.$element=a(a(c).is("body")?window:c),this.$body=a("body"),this.$scrollElement=this.$element.on("scroll.bs.scroll-spy.data-api",f),this.options=a.extend({},b.DEFAULTS,d),this.selector=(this.options.target||(e=a(c).attr("href"))&&e.replace(/.*(?=#[^\s]+$)/,"")||"")+" .nav li > a",this.offsets=a([]),this.targets=a([]),this.activeTarget=null,this.refresh(),this.process()}b.DEFAULTS={offset:10},b.prototype.refresh=function(){var b=this.$element[0]==window?"offset":"position";this.offsets=a([]),this.targets=a([]);{var c=this;this.$body.find(this.selector).map(function(){var d=a(this),e=d.data("target")||d.attr("href"),f=/^#./.test(e)&&a(e);return f&&f.length&&f.is(":visible")&&[[f[b]().top+(!a.isWindow(c.$scrollElement.get(0))&&c.$scrollElement.scrollTop()),e]]||null}).sort(function(a,b){return a[0]-b[0]}).each(function(){c.offsets.push(this[0]),c.targets.push(this[1])})}},b.prototype.process=function(){var a,b=this.$scrollElement.scrollTop()+this.options.offset,c=this.$scrollElement[0].scrollHeight||this.$body[0].scrollHeight,d=c-this.$scrollElement.height(),e=this.offsets,f=this.targets,g=this.activeTarget;if(b>=d)return g!=(a=f.last()[0])&&this.activate(a);if(g&&b<=e[0])return g!=(a=f[0])&&this.activate(a);for(a=e.length;a--;)g!=f[a]&&b>=e[a]&&(!e[a+1]||b<=e[a+1])&&this.activate(f[a])},b.prototype.activate=function(b){this.activeTarget=b,a(this.selector).parentsUntil(this.options.target,".active").removeClass("active");var c=this.selector+'[data-target="'+b+'"],'+this.selector+'[href="'+b+'"]',d=a(c).parents("li").addClass("active");d.parent(".dropdown-menu").length&&(d=d.closest("li.dropdown").addClass("active")),d.trigger("activate.bs.scrollspy")};var c=a.fn.scrollspy;a.fn.scrollspy=function(c){return this.each(function(){var d=a(this),e=d.data("bs.scrollspy"),f="object"==typeof c&&c;e||d.data("bs.scrollspy",e=new b(this,f)),"string"==typeof c&&e[c]()})},a.fn.scrollspy.Constructor=b,a.fn.scrollspy.noConflict=function(){return a.fn.scrollspy=c,this},a(window).on("load",function(){a('[data-spy="scroll"]').each(function(){var b=a(this);b.scrollspy(b.data())})})}(jQuery),+function(a){"use strict";var b=function(b){this.element=a(b)};b.prototype.show=function(){var b=this.element,c=b.closest("ul:not(.dropdown-menu)"),d=b.data("target");if(d||(d=b.attr("href"),d=d&&d.replace(/.*(?=#[^\s]*$)/,"")),!b.parent("li").hasClass("active")){var e=c.find(".active:last a")[0],f=a.Event("show.bs.tab",{relatedTarget:e});if(b.trigger(f),!f.isDefaultPrevented()){var g=a(d);this.activate(b.parent("li"),c),this.activate(g,g.parent(),function(){b.trigger({type:"shown.bs.tab",relatedTarget:e})})}}},b.prototype.activate=function(b,c,d){function e(){f.removeClass("active").find("> .dropdown-menu > .active").removeClass("active"),b.addClass("active"),g?(b[0].offsetWidth,b.addClass("in")):b.removeClass("fade"),b.parent(".dropdown-menu")&&b.closest("li.dropdown").addClass("active"),d&&d()}var f=c.find("> .active"),g=d&&a.support.transition&&f.hasClass("fade");g?f.one(a.support.transition.end,e).emulateTransitionEnd(150):e(),f.removeClass("in")};var c=a.fn.tab;a.fn.tab=function(c){return this.each(function(){var d=a(this),e=d.data("bs.tab");e||d.data("bs.tab",e=new b(this)),"string"==typeof c&&e[c]()})},a.fn.tab.Constructor=b,a.fn.tab.noConflict=function(){return a.fn.tab=c,this},a(document).on("click.bs.tab.data-api",'[data-toggle="tab"], [data-toggle="pill"]',function(b){b.preventDefault(),a(this).tab("show")})}(jQuery),+function(a){"use strict";var b=function(c,d){this.options=a.extend({},b.DEFAULTS,d),this.$window=a(window).on("scroll.bs.affix.data-api",a.proxy(this.checkPosition,this)).on("click.bs.affix.data-api",a.proxy(this.checkPositionWithEventLoop,this)),this.$element=a(c),this.affixed=this.unpin=this.pinnedOffset=null,this.checkPosition()};b.RESET="affix affix-top affix-bottom",b.DEFAULTS={offset:0},b.prototype.getPinnedOffset=function(){if(this.pinnedOffset)return this.pinnedOffset;this.$element.removeClass(b.RESET).addClass("affix");var a=this.$window.scrollTop(),c=this.$element.offset();return this.pinnedOffset=c.top-a},b.prototype.checkPositionWithEventLoop=function(){setTimeout(a.proxy(this.checkPosition,this),1)},b.prototype.checkPosition=function(){if(this.$element.is(":visible")){var c=a(document).height(),d=this.$window.scrollTop(),e=this.$element.offset(),f=this.options.offset,g=f.top,h=f.bottom;"top"==this.affixed&&(e.top+=d),"object"!=typeof f&&(h=g=f),"function"==typeof g&&(g=f.top(this.$element)),"function"==typeof h&&(h=f.bottom(this.$element));var i=null!=this.unpin&&d+this.unpin<=e.top?!1:null!=h&&e.top+this.$element.height()>=c-h?"bottom":null!=g&&g>=d?"top":!1;if(this.affixed!==i){this.unpin&&this.$element.css("top","");var j="affix"+(i?"-"+i:""),k=a.Event(j+".bs.affix");this.$element.trigger(k),k.isDefaultPrevented()||(this.affixed=i,this.unpin="bottom"==i?this.getPinnedOffset():null,this.$element.removeClass(b.RESET).addClass(j).trigger(a.Event(j.replace("affix","affixed"))),"bottom"==i&&this.$element.offset({top:c-h-this.$element.height()}))}}};var c=a.fn.affix;a.fn.affix=function(c){return this.each(function(){var d=a(this),e=d.data("bs.affix"),f="object"==typeof c&&c;e||d.data("bs.affix",e=new b(this,f)),"string"==typeof c&&e[c]()})},a.fn.affix.Constructor=b,a.fn.affix.noConflict=function(){return a.fn.affix=c,this},a(window).on("load",function(){a('[data-spy="affix"]').each(function(){var b=a(this),c=b.data();c.offset=c.offset||{},c.offsetBottom&&(c.offset.bottom=c.offsetBottom),c.offsetTop&&(c.offset.top=c.offsetTop),b.affix(c)})})}(jQuery);
--------------------------------------------------------------------------------
/login1.php:
--------------------------------------------------------------------------------
1 |
4 |
5 |
6 |
7 | SQL Injection Demo
14 |
15 |
22 |
54 |
55 |
56 |
57 | Vulnerable Standard Login
58 |
59 |
63 |
64 |
87 |
88 | num_rows > 0)
102 | {
103 | echo "
Authenticated as " . $username . "
";
104 |
105 | // ...
106 | // $_SESSION['logged_user'] = $username;
107 | // ...
108 | }
109 | else
110 | {
111 | echo "
Wrong username/password combination.
";
112 | }
113 | ?>
114 |
115 |
116 |
117 |
118 |
Query Executed:
119 |
120 |
121 |
122 |
129 |
130 |
131 |
132 |
133 |
134 |
135 |
PHP Code:
136 |
137 |
138 |
139 |
140 |
141 |
142 |
143 | $username = $_POST['username'];
144 | $password = $_POST['password'];
145 |
146 | $query = sprintf("SELECT * FROM users WHERE username = '%s' AND password = '%s';",
147 | $username,
148 | $password);
149 |
150 | $result = mysqli_query($connection, $query);
151 |
152 | if ($result->num_rows > 0)
153 | {
154 | echo "Authenticated as " . $username;
155 |
156 | // ...
157 | // $_SESSION['logged_user'] = $username;
158 | // ...
159 | }
160 | else
161 | {
162 | echo "Wrong username/password combination.";
163 | }
164 |
165 |
166 |
167 |
168 |
169 |
170 |
171 |
172 |
Vulnerability:
173 |
174 |
175 |
176 |
177 |
178 |
179 |
180 | Pass 1' OR '1'='1 as password to get authenticated.
181 |
182 |
183 |
184 |
185 |
186 |
187 |
188 |
189 |
190 |
SQL Injection Demo
14 |
15 |
22 |
54 |
55 |
56 |
57 | Secure Standard Login
58 |
59 |
63 |
64 |
87 |
88 | num_rows > 0)
102 | {
103 | echo "
Authenticated as " . $username . "
";
104 |
105 | // ...
106 | // $_SESSION['logged_user'] = $username;
107 | // ...
108 | }
109 | else
110 | {
111 | echo "
Wrong username/password combination.
";
112 | }
113 | ?>
114 |
115 |
116 |
117 |
118 |
Query Executed:
119 |
120 |
121 |
122 |
129 |
130 |
131 |
132 |
133 |
134 |
135 |
PHP Code:
136 |
137 |
138 |
139 |
140 |
141 |
142 |
143 | $username = $_POST['username'];
144 | $password = $_POST['password'];
145 |
146 | $query = sprintf("SELECT * FROM users WHERE username = '%s' AND password = '%s';",
147 | mysqli_real_escape_string($connection, $username),
148 | mysqli_real_escape_string($connection, $password));
149 |
150 | $result = mysqli_query($connection, $query);
151 |
152 | if ($result->num_rows > 0)
153 | {
154 | echo "Authenticated as " . $username;
155 |
156 | // ...
157 | // $_SESSION['logged_user'] = $username;
158 | // ...
159 | }
160 | else
161 | {
162 | echo "Wrong username/password combination.";
163 | }
164 |
165 |
166 |
167 |
168 |
169 |
170 |
171 |
172 |
173 |
SQL Injection Demo
14 |
15 |
22 |
54 |
55 |
56 |
57 | Vulnerable Numeric Login
58 |
59 |
63 |
64 |
87 |
88 | num_rows > 0)
102 | {
103 | echo "
Authenticated as " . $client . "
";
104 |
105 | // ...
106 | // $_SESSION['logged_user'] = $client;
107 | // ...
108 | }
109 | else
110 | {
111 | echo "
Wrong client/PIN combination.
";
112 | }
113 | ?>
114 |
115 |
116 |
117 |
118 |
Query Executed:
119 |
120 |
121 |
122 |
129 |
130 |
131 |
132 |
133 |
134 |
135 |
PHP Code:
136 |
137 |
138 |
139 |
140 |
141 |
142 |
143 | $client = $_POST['client'];
144 | $pin = $_POST['pin'];
145 |
146 | $query = sprintf("SELECT * FROM clients WHERE id = %s AND pin = %s;",
147 | mysqli_real_escape_string($connection, $client),
148 | mysqli_real_escape_string($connection, $pin));
149 |
150 | $result = mysqli_query($connection, $query);
151 |
152 | if ($result->num_rows > 0)
153 | {
154 | echo "Authenticated as " . $client;
155 |
156 | // ...
157 | // $_SESSION['logged_user'] = $client;
158 | // ...
159 | }
160 | else
161 | {
162 | echo "Wrong client/PIN combination.";
163 | }
164 |
165 |
166 |
167 |
168 |
169 |
170 |
171 |
172 |
Vulnerability:
173 |
174 |
175 |
176 |
177 |
178 |
179 |
180 | Pass 1 OR 1=1 as PIN to get authenticated.
181 |
182 |
183 |
184 |
185 |
186 |
187 |
188 |
189 |
190 |
SQL Injection Demo
14 |
15 |
22 |
54 |
55 |
56 |
57 | Secure Numeric Login
58 |
59 |
63 |
64 |
87 |
88 | num_rows > 0)
104 | {
105 | echo "
Authenticated as " . $client . "
";
106 |
107 | // ...
108 | // $_SESSION['logged_user'] = $client;
109 | // ...
110 | }
111 | else
112 | {
113 | echo "
Wrong client/PIN combination.
";
114 | }
115 | }
116 | else
117 | {
118 | echo "
Client ID and PIN must be numeric values.
";
119 | }
120 | ?>
121 |
122 |
123 |
124 |
125 |
Query Executed:
126 |
127 |
128 |
129 |
136 |
137 |
138 |
139 |
140 |
141 |
142 |
PHP Code:
143 |
144 |
145 |
146 |
147 |
148 |
149 |
150 | $client = $_POST['client'];
151 | $pin = $_POST['pin'];
152 |
153 | if (is_numeric($client) && is_numeric($pin))
154 | {
155 | $query = sprintf("SELECT * FROM clients WHERE id = %s AND pin = %s;",
156 | mysqli_real_escape_string($connection, $client),
157 | mysqli_real_escape_string($connection, $pin));
158 |
159 | $result = mysqli_query($connection, $query);
160 |
161 | if ($result->num_rows > 0)
162 | {
163 | echo "Authenticated as " . $client;
164 |
165 | // ...
166 | // $_SESSION['logged_user'] = $client;
167 | // ...
168 | }
169 | else
170 | {
171 | echo "Wrong client/PIN combination.";
172 | }
173 | }
174 | else
175 | {
176 | echo "Client ID and PIN must be numeric values.";
177 | }
178 |
179 |
180 |
181 |
182 |
183 |
184 |
185 |
186 |
187 |
SQL Injection Demo
14 |
15 |
22 |
54 |
55 |
56 |
57 | Regular Expression Checker
58 |
59 |
82 |
83 |
84 |
85 |
104 |
105 |
110 |
111 |
112 |
113 |
114 |
115 |
116 |
117 |
118 |
119 |
Regex reference:
120 |
121 |
122 |
123 |
124 |
125 |
126 |
127 | [abc] A single character: a, b or c
128 | [^abc] Any single character but a, b, or c
129 | [a-z] Any single character in the range a-z
130 | [a-zA-Z] Any single character in the range a-z or A-Z
131 | ^ Start of line
132 | $ End of line
133 | \A Start of string
134 | \z End of string
135 | . Any single character
136 | \s Any whitespace character
137 | \S Any non-whitespace character
138 | \d Any digit
139 | \D Any non-digit
140 | \w Any word character (letter, number, underscore)
141 | \W Any non-word character
142 | \b Any word boundary character
143 | (...) Capture everything enclosed
144 | (a|b) a or b
145 | a? Zero or one of a
146 | a* Zero or more of a
147 | a+ One or more of a
148 | a{3} Exactly 3 of a
149 | a{3,} 3 or more of a
150 | a{3,6} Between 3 and 6 of a
151 |
152 |
153 |
Detailed informations: http://www.php.net/manual/en/regexp.introduction.php
154 |
155 |
156 |
157 |
158 |
164 |
165 |
166 |
167 |
168 |
Example
169 |
170 |
171 |
172 |
173 |
174 |
175 | Regular expression /^[a-z]{2,4}+[0-9]{2}$/ matches strings that begin with 2-4 literal characters (a-z) and end with 2 numeric characters (0-9).
176 |
177 |
178 |
179 |
180 |
181 |
182 |
183 |
184 |