PHP code
<?php
include "sql_and_php_debug.php";
mysql_connect("localhost", "level24", "Bys5OfaTcI6BKnjdrFzmkw==");
mysql_select_db("level24");
?>
<h1>Shop</h1>
Try to dump the database through an SQL-injection (what parameter to test? how to use sqlmap?)
<?php
if (!isset($_GET['product_id'])) {
?>
<h2>Our products:</h2>
<?php
$res = mysql_query("SELECT id, label FROM products");
while ($row = mysql_fetch_assoc($res)) {
echo "$row[id] — <a href='?product_id=$row[id]'>$row[label]</a><p/>";
}
} else {
?>
<h2>Product description</h2>
<a href='?'>« back</a><p/>
<?php
$res = mysql_query("SELECT * FROM products WHERE id = '$_GET[product_id]'");
$row = mysql_fetch_assoc($res);
echo "<h3>$row[label]</h3><p/>$row[description]";
}
SQL debug
Shop
Try to dump the database through an SQL-injection (what parameter to test? how to use sqlmap?)
Product description
« back
Spoon
Aluminium spoon, made in USSR