|
10 | 10 |
|
11 | 11 | <p><strong>Valid customers are:</strong> Arthur Dent, Ford Prefect, Tricia Trillian McMillan, Zaphod Beeblebrox, Marvin, Slartibartfast</p> |
12 | 12 |
|
13 | | - <h2>Using Statement</h2> |
14 | | - |
| 13 | + <p>Use <strong>' or '1'='1</strong> to attack the database.</p> |
| 14 | + |
15 | 15 | <form name="stmt" method="post" action="StatementServlet"> |
16 | | - <table> |
17 | | - <tr> |
18 | | - <td><label for="stmt" title="Name">Name</label></td> |
19 | | - <td><input type="text" id="stmt" name="name" class="text-input" /></td> |
20 | | - <td><input type="submit" value="Submit" /></td> |
21 | | - </tr> |
22 | | - </table> |
| 16 | + <fieldset> |
| 17 | + <legend>Using a simple Statement</legend> |
| 18 | + <label for="stmt" title="Name">Name</label> |
| 19 | + <input type="text" id="stmt" name="name" class="text-input" /> |
| 20 | + <input type="submit" value="Search" /> |
| 21 | + </fieldset> |
23 | 22 | </form> |
24 | 23 |
|
25 | | - <h2>Using Statement with Escaping</h2> |
26 | | - |
27 | 24 | <form name="stmtEsc" method="post" action="StatementEscapingServlet"> |
28 | | - <table> |
29 | | - <tr> |
30 | | - <td><label for="stmtEsc" title="Name">Name</label></td> |
31 | | - <td><input type="text" id="stmtEsc" name="name" class="text-input" /></td> |
32 | | - <td><input type="submit" value="Submit" /></td> |
33 | | - </tr> |
34 | | - </table> |
| 25 | + <fieldset> |
| 26 | + <legend>Using an escaped Statement</legend> |
| 27 | + <label for="stmtEsc" title="Name">Name</label> |
| 28 | + <input type="text" id="stmtEsc" name="name" class="text-input" /> |
| 29 | + <input type="submit" value="Search" /> |
| 30 | + </fieldset> |
35 | 31 | </form> |
36 | 32 |
|
37 | | - <h2>Using Prepared Statement</h2> |
38 | | - |
39 | 33 | <form name="pstmt" method="post" action="PreparedStatementServlet"> |
40 | | - <table> |
41 | | - <tr> |
42 | | - <td><label for="pstmt" title="Name">Name</label></td> |
43 | | - <td><input type="text" id="pstmt" name="name" class="text-input" /></td> |
44 | | - <td><input type="submit" name="submit" value="Submit" /></td> |
45 | | - </tr> |
46 | | - </table> |
| 34 | + <fieldset> |
| 35 | + <legend>Using a Prepared Statement</legend> |
| 36 | + <label for="pstmt" title="Name">Name</label> |
| 37 | + <input type="text" id="pstmt" name="name" class="text-input" /> |
| 38 | + <input type="submit" name="submit" value="Search" /> |
| 39 | + </fieldset> |
47 | 40 | </form> |
48 | 41 |
|
49 | | - <h2>Using Hibernate Query Language (HQL)</h2> |
50 | | - |
51 | 42 | <form name="hql" method="post" action="HQLServlet"> |
52 | | - <table> |
53 | | - <tr> |
54 | | - <td><label for="hql" title="Name">Name</label></td> |
55 | | - <td><input type="text" id="hql" name="name" class="text-input" /></td> |
56 | | - <td><input type="submit" name="submit" value="Submit" /></td> |
57 | | - </tr> |
58 | | - </table> |
| 43 | + <fieldset> |
| 44 | + <legend>Using the Hibernate Query Language (HQL)</legend> |
| 45 | + <label for="hql" title="Name">Name</label> |
| 46 | + <input type="text" id="hql" name="name" class="text-input" /> |
| 47 | + <input type="submit" name="submit" value="Search" /> |
| 48 | + </fieldset> |
59 | 49 | </form> |
60 | 50 | </body> |
61 | 51 | </html> |
0 commit comments