search

jameshsu960 / Rate-my-TA

0 stars 2 forks source link

Student Panel - Protect against SQL/HTML Injection #96

Open Minikhil opened 6 years ago

terrellg commented 6 years ago

Script for test case

go to http://www-student.cse.buffalo.edu/CSE442-542/2018-Summer/team04/feedbackform

fill out form normally then...

In any of the description fields type in order to test for HTML Injection paste this:

My mother has <span style="color:blue;font-weight:bold">blue eyes and my father has <span style="color:darkolivegreen;font-weight:bold">dark green eyes.

Check professor panel and see if the text color has changed

SQL Injection:

  1. go to http://www-student.cse.buffalo.edu/CSE442-542/2018-Summer/team04/login.php

  2. insert ' or 1-- as username

3 password leave blank

  1. Unable to login so safe from sql injection