Paul
/
Security-VM
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Changed database slightly

Browse Source
Paul Wagener 11 years ago
parent 398634668a
commit 9e613b7cc8
4 changed files with 42 additions and 111 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 97
      bank/product_detail.php
  2. 52
      build-vm/database.sql
  3. 2
      webshop/index.php
  4. 2
      webshop/product_detail.php

97
bank/product_detail.php
Unescape View File

@ -1,97 +0,0 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Lekkende Kranen Empirium</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="description" content="">
<meta name="author" content="Paul Wagener">
<link id="callCss" rel="stylesheet" href="/themes/bootshop/bootstrap.min.css" media="screen"/>
<link href="/themes/css/base.css" rel="stylesheet" media="screen"/>
<link href="/themes/css/bootstrap-responsive.min.css" rel="stylesheet"/>
<link href="/themes/css/font-awesome.css" rel="stylesheet" type="text/css">
</head>
<body>
<div id="header">
<div class="container">
<div id="welcomeLine" class="row">
</div>
<!-- Navbar ================================================== -->
<div id="logoArea" class="navbar">
<a id="smallScreen" data-target="#topMenu" data-toggle="collapse" class="btn btn-navbar">
<span class="icon-bar"></span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
</a>
<div class="navbar-inner">
<a class="brand" href="/webshop"><img src="/themes/images/logo.png" alt="Leaky's Kranen Emporium"/></a>
<form class="form-inline navbar-search" method="post" action="products.html" >
</form>
<ul id="topMenu" class="nav pull-right">
</ul>
</div>
</div>
</div>
</div>
<!-- Header End====================================================================== -->
<div id="mainBody">
<div class="container">
<div class="row">
<div class="span12">
<?php
/**
* Maak verbinding met de database
*/
$connection = mysql_connect('localhost', 'webshop', 'pass')
or die('Kan geen verbinding maken met MySQL');
$db = mysql_select_db('webshop_sql1', $connection)
or die('Could not select database');
$query = 'SELECT naam, afbeelding, beschrijving, prijs FROM producten WHERE id = ' . $_GET['id'];
$result = mysql_query($query)
or die('<div class="alert alert-danger">Query error: <pre>' . mysql_error() . '</pre>Query: <code>' . $query . '</code> </div>');
$row = mysql_fetch_array($result);
mysql_close($connection);
?>
<div class="row">
<div id="gallery" class="span3">
<img src="/themes/images/products/<?php echo $row['afbeelding'] ?>" style="width:100%"/>
</div>
<div class="span6">
<h3><?php echo $row['naam'] ?></h3>
<small><?php echo $row['beschrijving'] ?></small>
<hr class="soft"/>
<form class="form-horizontal qtyFrm">
<div class="control-group">
<label class="control-label"><span>&euro;<?php echo $row['prijs'] ?></span></label>
</form>
<hr class="soft"/>
<h4>Dit item is op voorraad</h4>
</div>
</div>
</div>
</div>
<!-- MainBody End ============================= -->
</body>
</html>

52
build-vm/database.sql
Unescape View File

@ -4,28 +4,32 @@
CREATE DATABASE IF NOT EXISTS temp; CREATE DATABASE IF NOT EXISTS temp;
DROP PROCEDURE IF EXISTS `temp`.`drop_user_if_exists` ; DROP PROCEDURE IF EXISTS `temp`.`drop_user_if_exists` ;
DELIMITER $$ DELIMITER $$
CREATE PROCEDURE `temp`.`drop_user_if_exists`() CREATE PROCEDURE `temp`.`drop_user_if_exists`(username VARCHAR(100))
BEGIN BEGIN
DECLARE foo BIGINT DEFAULT 0 ; DECLARE foo BIGINT DEFAULT 0 ;
SELECT COUNT(*) SELECT COUNT(*)
INTO foo INTO foo
FROM `mysql`.`user` FROM `mysql`.`user`
WHERE `User` = 'webshop' ; WHERE `User` = username;
IF foo > 0 THEN IF foo > 0 THEN
DROP USER 'webshop'@'localhost' ; SELECT CONCAT('DROP USER ', GROUP_CONCAT(CONCAT(QUOTE(username), '@', QUOTE('localhost'))))
INTO @sql;
PREPARE stmt FROM @sql;
EXECUTE stmt;
END IF; END IF;
END ;$$ END ;$$
DELIMITER ; DELIMITER ;
CALL `temp`.`drop_user_if_exists`() ; CALL `temp`.`drop_user_if_exists`('webshop') ;
CALL `temp`.`drop_user_if_exists`('bank') ;
DROP DATABASE temp; DROP DATABASE temp;
CREATE USER 'webshop'@'localhost' IDENTIFIED BY 'pass'; CREATE USER 'webshop'@'localhost' IDENTIFIED BY 'pass';
GRANT ALL PRIVILEGES ON `webshop\_%` . * TO 'webshop'@'localhost'; GRANT ALL PRIVILEGES ON `webshop`.* TO 'webshop'@'localhost';
DROP DATABASE IF EXISTS webshop_sql1; DROP DATABASE IF EXISTS webshop;
CREATE DATABASE webshop_sql1; CREATE DATABASE webshop;
USE webshop_sql1; USE webshop;
CREATE TABLE `gebruikers` ( CREATE TABLE `gebruikers` (
`id` int(11) NOT NULL, `id` int(11) NOT NULL,
@ -35,10 +39,10 @@ CREATE TABLE `gebruikers` (
) ENGINE=InnoDB DEFAULT CHARSET=latin1; ) ENGINE=InnoDB DEFAULT CHARSET=latin1;
INSERT INTO `gebruikers` (`id`, `gebruikersnaam`, `wachtwoord`) VALUES INSERT INTO `gebruikers` (`id`, `gebruikersnaam`, `wachtwoord`) VALUES
(1, 'admin', 'ikbenzoslim'), (1, 'Admin', 'ikbenzoslim'),
(2, 'paul', 'wachtwoord12345'), (2, 'Paul', 'wachtwoord12345'),
(3, 'wim', '1337hacker'), (3, 'Wim', '1337hacker'),
(4, 'marco', 'apple4ever'); (4, 'Marco', 'apple4ever');
CREATE TABLE `producten` ( CREATE TABLE `producten` (
`id` int(11) NOT NULL, `id` int(11) NOT NULL,
@ -54,3 +58,27 @@ INSERT INTO `producten` (`id`, `naam`, `prijs`, `beschrijving`, `afbeelding`) VA
(1, 'Kraan Basis', 5.00, 'Kraan zonder poespas', 'basis.jpg'), (1, 'Kraan Basis', 5.00, 'Kraan zonder poespas', 'basis.jpg'),
(2, 'Geldkraan', 30.00, 'Lastig open te draaien, maar makkelijk om dicht te draaien. Betaalt zichzelf terug', 'geld.jpg'), (2, 'Geldkraan', 30.00, 'Lastig open te draaien, maar makkelijk om dicht te draaien. Betaalt zichzelf terug', 'geld.jpg'),
(4, 'Dubbel afsluitbare kraan', 40.00, 'Voor als u nog zekerder wilt zijn dat uw kraan niet lekt', 'kurk.jpg'); (4, 'Dubbel afsluitbare kraan', 40.00, 'Voor als u nog zekerder wilt zijn dat uw kraan niet lekt', 'kurk.jpg');
CREATE USER 'bank'@'localhost' IDENTIFIED BY 'pass';
GRANT ALL PRIVILEGES ON `bank`.* TO 'bank'@'localhost';
DROP DATABASE IF EXISTS bank;
CREATE DATABASE bank;
USE bank;
CREATE TABLE `gebruikers` (
`gebruikersnaam` varchar(255) NOT NULL,
`wachtwoord` varchar(255) NOT NULL,
`balans` decimal(10,2) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
--
-- Gegevens worden uitgevoerd voor tabel `gebruikers`
--
INSERT INTO `gebruikers` (`gebruikersnaam`, `wachtwoord`, `balans`) VALUES
('Alice', 'fluviusmaximus', 2600.00),
('Bob', '123456', 10.00),
('Carol', 'cuteasabuttonintheeyes', 42.00);

2
webshop/index.php
Unescape View File

@ -65,7 +65,7 @@
$connection = mysql_connect('localhost', 'webshop', 'pass') $connection = mysql_connect('localhost', 'webshop', 'pass')
or die('Kan geen verbinding maken met MySQL'); or die('Kan geen verbinding maken met MySQL');
$db = mysql_select_db('webshop_sql1', $connection) $db = mysql_select_db('webshop', $connection)
or die('Kan de database niet selecteren'); or die('Kan de database niet selecteren');

2
webshop/product_detail.php
Unescape View File

@ -56,7 +56,7 @@
$connection = mysql_connect('localhost', 'webshop', 'pass') $connection = mysql_connect('localhost', 'webshop', 'pass')
or die('Kan geen verbinding maken met MySQL'); or die('Kan geen verbinding maken met MySQL');
$db = mysql_select_db('webshop_sql1', $connection) $db = mysql_select_db('webshop', $connection)
or die('Could not select database'); or die('Could not select database');
$query = 'SELECT naam, afbeelding, beschrijving, prijs FROM producten WHERE id = ' . mysql_real_escape_string($_GET['id']); $query = 'SELECT naam, afbeelding, beschrijving, prijs FROM producten WHERE id = ' . mysql_real_escape_string($_GET['id']);

Write Preview
Loading…
Cancel
Save