At the entrance we get a GET of the form localhost / stat.php? C = Russia. It is necessary through a request to the database to find out who "owns" the country. Ie the value of the country in the field is greater than or equal to 1. Next, output the nick-name of the "owner" and the numeric value in the field separated by a space. If the value is 0, output "not found". To clarify, the value can be positive in only one field. The presence of sql injection vulnerability does not matter. I myself, of course, tried it, but the result could not be obtained.

I would be very grateful for the code. That's what I have.

<?php $country = $_GET['c']; // данные доступа к базе данных $db_host="localhost"; // обычно не нужно изменять $db_user="??"; // имя пользователя БД $db_password="??"; // пароль БД $db_name = "??"; // имя БД $mysqli = new mysqli($db_host, $db_user, $db_password, $db_name); if (mysqli_connect_errno()) { printf("Ошибка соединения: %s\n", mysqli_connect_error()); exit; } $mysqli->set_charset("utf8"); // Выполняем запрос: выбрать пользователей, которые посетили приложение более 10 раз if ($stmt = $mysqli->query('SELECT * FROM `users` WHERE `$country`>0')) { // выводим данные while($row = $stmt->fetch_assoc()){ echo $row['nickname'].' '.$row['$country'].'<br />'; } }

DB type

  • Can you show what you tried? - Mikhail Rebrov
  • Yes, of course, added - artbotva

1 answer 1

With such a database architecture, vulnerability really does not matter :)

Users and countries should be in different tables, your database architecture is a violation of the normal forms of the database without any obvious need leading to such dances with a tambourine (New country - new column)

In the simplest case, create the country table with the fields id, name, owner_id, where id is the primary key, name varchar, owner_id int (foreign key to the user (id) table)

Further, through JOIN, select the owner:

SELECT user.nickname FROM country JOIN user ON user.id = country.owner_id WHERE country.name = 'Russia';

If nothing was found, then with empty results return not found.