sql injection demo

Author: greyshell

web/sqli/app.py

@@ -71,7 +71,7 @@ def tbl_post03():
     random_string = ''.join(random.SystemRandom().choice(string.ascii_letters + string.digits) for _ in range(10))
     user = 'anonymous' + '-' + random_string
     # check if the user already exists
-    return_type = model.is_exist_user(user)
+    return_type, rows = model.is_exist_user(user)
     if return_type:
         return render_template("case03.html", error='user already exists / had exception')
 

web/sqli/models/tblpost03.py

@@ -63,4 +63,4 @@ def is_exist_user(self, user):
             print(e)
             cursor.close()
             self.db.conn.close()
-            return False
+            return False, e