Paul/Security-VM
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Changed database slightly

Browse Source
This commit is contained in:
Paul committed 2014-02-20 16:21:06 +01:00
1 parent 398634668a
commit 9e613b7cc8
4 files changed
+42 -111
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

bank/product_detail.php
-97
View File
@@ -1,97 +0,0 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Lekkende Kranen Empirium</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="description" content="">
<meta name="author" content="Paul Wagener">
<link id="callCss" rel="stylesheet" href="/themes/bootshop/bootstrap.min.css" media="screen"/>
<link href="/themes/css/base.css" rel="stylesheet" media="screen"/>
<link href="/themes/css/bootstrap-responsive.min.css" rel="stylesheet"/>
<link href="/themes/css/font-awesome.css" rel="stylesheet" type="text/css">
</head>
<body>
<div id="header">
<div class="container">
<div id="welcomeLine" class="row">
</div>
<!-- Navbar ================================================== -->
<div id="logoArea" class="navbar">
<a id="smallScreen" data-target="#topMenu" data-toggle="collapse" class="btn btn-navbar">
<span class="icon-bar"></span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
</a>
<div class="navbar-inner">
<a class="brand" href="/webshop"><img src="/themes/images/logo.png" alt="Leaky's Kranen Emporium"/></a>
<form class="form-inline navbar-search" method="post" action="products.html" >
</form>
<ul id="topMenu" class="nav pull-right">
</ul>
</div>
</div>
</div>
</div>
<!-- Header End====================================================================== -->
<div id="mainBody">
<div class="container">
<div class="row">
<div class="span12">
<?php
/**
* Maak verbinding met de database
*/
$connection = mysql_connect('localhost', 'webshop', 'pass')
or die('Kan geen verbinding maken met MySQL');
$db = mysql_select_db('webshop_sql1', $connection)
or die('Could not select database');
$query = 'SELECT naam, afbeelding, beschrijving, prijs FROM producten WHERE id = ' . $_GET['id'];
$result = mysql_query($query)
or die('<div class="alert alert-danger">Query error: <pre>' . mysql_error() . '</pre>Query: <code>' . $query . '</code> </div>');
$row = mysql_fetch_array($result);
mysql_close($connection);
?>
<div class="row">
<div id="gallery" class="span3">
<img src="/themes/images/products/<?php echo $row['afbeelding'] ?>" style="width:100%"/>
</div>
<div class="span6">
<h3><?php echo $row['naam'] ?></h3>
<small><?php echo $row['beschrijving'] ?></small>
<hr class="soft"/>
<form class="form-horizontal qtyFrm">
<div class="control-group">
<label class="control-label"><span>&euro;<?php echo $row['prijs'] ?></span></label>
</form>
<hr class="soft"/>
<h4>Dit item is op voorraad</h4>
</div>
</div>
</div>
</div>
<!-- MainBody End ============================= -->
</body>
</html>
build-vm/database.sql
+40 -12
View File
@@ -4,28 +4,32 @@
CREATE DATABASE IF NOT EXISTS temp;
DROP PROCEDURE IF EXISTS `temp`.`drop_user_if_exists` ;
DELIMITER $$
CREATE PROCEDURE `temp`.`drop_user_if_exists`()
CREATE PROCEDURE `temp`.`drop_user_if_exists`(username VARCHAR(100))
BEGIN
DECLARE foo BIGINT DEFAULT 0 ;
SELECT COUNT(*)
INTO foo
FROM `mysql`.`user`
WHERE `User` = 'webshop' ;
WHERE `User` = username;
IF foo > 0 THEN
DROP USER 'webshop'@'localhost' ;
SELECT CONCAT('DROP USER ', GROUP_CONCAT(CONCAT(QUOTE(username), '@', QUOTE('localhost'))))
INTO @sql;
PREPARE stmt FROM @sql;
EXECUTE stmt;
END IF;
END ;$$
DELIMITER ;
CALL `temp`.`drop_user_if_exists`() ;
CALL `temp`.`drop_user_if_exists`('webshop') ;
CALL `temp`.`drop_user_if_exists`('bank') ;
DROP DATABASE temp;
CREATE USER 'webshop'@'localhost' IDENTIFIED BY 'pass';
GRANT ALL PRIVILEGES ON `webshop\_%` . * TO 'webshop'@'localhost';
GRANT ALL PRIVILEGES ON `webshop`.* TO 'webshop'@'localhost';
DROP DATABASE IF EXISTS webshop_sql1;
CREATE DATABASE webshop_sql1;
USE webshop_sql1;
DROP DATABASE IF EXISTS webshop;
CREATE DATABASE webshop;
USE webshop;
CREATE TABLE `gebruikers` (
`id` int(11) NOT NULL,
@@ -35,10 +39,10 @@ CREATE TABLE `gebruikers` (
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
INSERT INTO `gebruikers` (`id`, `gebruikersnaam`, `wachtwoord`) VALUES
(1, 'admin', 'ikbenzoslim'),
(2, 'paul', 'wachtwoord12345'),
(3, 'wim', '1337hacker'),
(4, 'marco', 'apple4ever');
(1, 'Admin', 'ikbenzoslim'),
(2, 'Paul', 'wachtwoord12345'),
(3, 'Wim', '1337hacker'),
(4, 'Marco', 'apple4ever');
CREATE TABLE `producten` (
`id` int(11) NOT NULL,
@@ -54,3 +58,27 @@ INSERT INTO `producten` (`id`, `naam`, `prijs`, `beschrijving`, `afbeelding`) VA
(1, 'Kraan Basis', 5.00, 'Kraan zonder poespas', 'basis.jpg'),
(2, 'Geldkraan', 30.00, 'Lastig open te draaien, maar makkelijk om dicht te draaien. Betaalt zichzelf terug', 'geld.jpg'),
(4, 'Dubbel afsluitbare kraan', 40.00, 'Voor als u nog zekerder wilt zijn dat uw kraan niet lekt', 'kurk.jpg');
CREATE USER 'bank'@'localhost' IDENTIFIED BY 'pass';
GRANT ALL PRIVILEGES ON `bank`.* TO 'bank'@'localhost';
DROP DATABASE IF EXISTS bank;
CREATE DATABASE bank;
USE bank;
CREATE TABLE `gebruikers` (
`gebruikersnaam` varchar(255) NOT NULL,
`wachtwoord` varchar(255) NOT NULL,
`balans` decimal(10,2) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
--
-- Gegevens worden uitgevoerd voor tabel `gebruikers`
--
INSERT INTO `gebruikers` (`gebruikersnaam`, `wachtwoord`, `balans`) VALUES
('Alice', 'fluviusmaximus', 2600.00),
('Bob', '123456', 10.00),
('Carol', 'cuteasabuttonintheeyes', 42.00);
webshop/index.php
+1 -1
View File
@@ -65,7 +65,7 @@
$connection = mysql_connect('localhost', 'webshop', 'pass')
or die('Kan geen verbinding maken met MySQL');
$db = mysql_select_db('webshop_sql1', $connection)
$db = mysql_select_db('webshop', $connection)
or die('Kan de database niet selecteren');
webshop/product_detail.php
+1 -1
View File
@@ -56,7 +56,7 @@
$connection = mysql_connect('localhost', 'webshop', 'pass')
or die('Kan geen verbinding maken met MySQL');
$db = mysql_select_db('webshop_sql1', $connection)
$db = mysql_select_db('webshop', $connection)
or die('Could not select database');
$query = 'SELECT naam, afbeelding, beschrijving, prijs FROM producten WHERE id = ' . mysql_real_escape_string($_GET['id']);