From 19bf1b8ac810371f75ff098f5db787d385b9d66f Mon Sep 17 00:00:00 2001
From: nkolosnjaj <n.kolosnaj@tesla-cloud.rs>
Date: Mon, 13 May 2024 14:31:00 +0200
Subject: [PATCH] exam151

---
 exam151/index.php | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 exam151/index.php

diff --git a/exam151/index.php b/exam151/index.php
new file mode 100644
index 0000000..f783cc8
--- /dev/null
+++ b/exam151/index.php
@@ -0,0 +1,30 @@
+<?php 
+// How to escape SQL Injection
+
+$con = mysqli_connect('localhost', 'example_user', 'Kolosnjaj4321!');
+mysqli_select_db($con, 'example_database');
+
+if(isset($_POST['username']) && isset($_POST['password'])){
+    $username = $_POST['username'];
+    $password = $_POST['password'];
+
+    if(!empty($username) && !empty($password)){
+        $query = "SELECT `id` FROM `users` WHERE `username` = '" . mysqli_real_escape_string($con,$username). "' AND `password` = '" .mysqli_real_escape_string($con,$password) ."'";
+        $query_run = mysqli_query($con, $query);    
+
+        if(mysqli_num_rows($query_run) >= 1){
+            echo 'Login success';
+        } else {
+            echo 'Invalid user or pass';    
+        }
+    }
+}
+
+
+?>
+
+<form action="index.php" method="POST">
+User: <input type="text" name="username"> <br>
+Pass: <input type="text" name="password"><br>
+<input type="submit" value="Submit">
+</form>
\ No newline at end of file