sync

zha0cai · Jun 21, 2024 · 1e1564e · 1e1564e
1 parent f73b124
commit 1e1564e
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 19 deletions.
diff --git a/src/main/java/org/owasp/webgoat/lessons/cryptography/mytest/PathChecker.java b/src/main/java/org/owasp/webgoat/lessons/cryptography/mytest/PathChecker.java
diff --git a/src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionChallenge.java b/src/main/java/org/owasp/webgoat/lessons/sqlinjection/advanced/SqlInjectionChallenge.java
@@ -66,6 +66,7 @@ public AttackResult registerNewUser(
         String checkUserQuery =
             "select userid from sql_challenge_users where userid = '" + username_reg + "'";
         Statement statement = connection.createStatement();
+        // 这里执行了 sql 语句，但是后面并没有回显
         ResultSet resultSet = statement.executeQuery(checkUserQuery);
 
         if (resultSet.next()) {
@@ -75,6 +76,7 @@ public AttackResult registerNewUser(
             attackResult = failed(this).feedback("user.exists").feedbackArgs(username_reg).build();
           }
         } else {
+          // 这里采用了预编译
           PreparedStatement preparedStatement =
               connection.prepareStatement("INSERT INTO sql_challenge_users VALUES (?, ?, ?)");
           preparedStatement.setString(1, username_reg);