diff --git a/hsql/src/Register.java b/hsql/src/Register.java
index ec7980c..08c205c 100644
--- a/hsql/src/Register.java
+++ b/hsql/src/Register.java
@@ -40,6 +40,7 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
pst.setString(3, phone);
int i=pst.executeUpdate();
out.write(i+" records inserted, View Records");
+ out.write("View Tests");
} catch (SQLException e) {
throw new ServletException(e);
}
diff --git a/hsql/src/ViewRecords.java b/hsql/src/ViewRecords.java
index b54ffda..2dd6739 100644
--- a/hsql/src/ViewRecords.java
+++ b/hsql/src/ViewRecords.java
@@ -11,9 +11,11 @@
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
+import java.util.HashMap;
public class ViewRecords extends HttpServlet {
Connection con;
+ HashMap methods;
@Override
public void init() throws ServletException {
try {
@@ -26,13 +28,23 @@ public void init() throws ServletException {
} catch (SQLException e) {
e.printStackTrace(System.out);
}
+
+ methods = new HashMap();
+ methods.put("str", "select * from contacts where name='%s'");
+ methods.put("int_groupby", "SELECT * FROM contacts GROUP BY %s");
+ methods.put("int_orderby", "SELECT * FROM contacts ORDER BY %s");
+ methods.put("int_inline", "%s");
}
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
response.setContentType("text/html");
PrintWriter out=response.getWriter();
try {
- String name = request.getParameter("name");
- ResultSet rs =con.createStatement().executeQuery("select * from contacts where name='" + name + "'");
+ String inject = request.getParameter("inject");
+ String method = request.getParameter("method");
+
+ String query = String.format((String)methods.get(method), inject);
+
+ ResultSet rs =con.createStatement().executeQuery(query);
while(rs.next()){
out.write("
"+rs.getString(1));
out.write(", "+rs.getString(2));
diff --git a/hsql/test.html b/hsql/test.html
new file mode 100644
index 0000000..39d344b
--- /dev/null
+++ b/hsql/test.html
@@ -0,0 +1,23 @@
+
+
+
+
+ Injection Tests
+
+
+
+
+
\ No newline at end of file