Cyber Security Essentials

exploitAtion 139

is query is more complex. It still retrieves the text of the blog entry,

as well as the name of the user who wrote it and the time of publica-

tion. It also includes a WHERE clause that specifies that the returned

data should only include blogs with the user’s name user1.

To achieve this, we might create a dynamic query that can accept

information from a program, like a Web application. Programmers

normally do this through a high-level language such as PHP, Perl,

or ASP. e following pseudocode shows how a programmer might

accomplish this:

#Get Username

username = getInputFromUser()

#Create SQL Query containing username

sql_query ...