sql injection demo

Author: greyshell

web/sqli/app.py

@@ -86,4 +86,4 @@ def tbl_post03():
 
 
 if __name__ == '__main__':
-    app.run(debug=True)
+    app.run(port=9000, debug=True)

web/sqli/models/tblpost03.py

@@ -57,7 +57,7 @@ def is_exist_user(self, user):
             cursor.close()
             if len(rows) > 0:
                 return True
-            return False
+            return False, rows
 
         except Exception as e:
             print(e)

web/sqli/template/case03.html

@@ -19,7 +19,7 @@ <h2>SQL Injection</h2>
 <i>author: greyshell</i><br><br>
 Objective: set the age of admin user <br><br>
 <form method="POST">
-    Enter your feedback:
+    Enter your feedback as anonymous user:
     <label>
         <input type="text" name="comment" size=100/>
     </label><br/><br/>