You have been provided with a sample page that contains a variety of security vulnerabilities. The page allows people to upload comments but is vulnerable to SQL injection and to cross-site scripting.

1. Examine ch16-proj1.html in the browser. Also examine process.php. This page does the actual saving of the data to the provided SQLite database (called security-sample.db) and will require you to have a running server environment such as XAMPP.

2. Test if your site is vulnerable to SQL Injection by typing in either of the following in the page’s search box:

   
   ' or 1=1; --
   ' or 1=1; drop table junk; --

   The second line will delete a table from your database.

3. Test if your site is vulnerable to XSS by saving the following in the comment field:

   
   <script type='text/javascript'>
   alert('XSS vulnerability found!');
   </script>

4. Use the view comments link to see the newly added comment. If the alert is executed, then the site is vulnerable to XSS.

5. Sanitize the user comment input via JavaScript by using the DOMPurify library. You will need to provide sanitization for already existing comments as well as for new comments. You will also need to add sanitization on the server in PHP using HTML Purifier; for less protection (but easier to implement now) you can use the htmlentities function in PHP.

6. Protect your PHP against SQL Injection. This will require using prepared statements, as shown in Chapter 12.

1. Test for SQL Injection and XSS exploits as shown in steps 2 and 3.

Create a registration and login system in PHP using the supplied users table (you have been supplied a SQLite database file as well as a SQL import script if using MySQL).

1. You have been provided with the HTML, CSS, and JavaScript for the login and the registration pages. Test and examine in a browser.

2. The users table has two different digests: one (the field password) created from a bcrypt algorithm, the other (the field password_sha256) created with the sha256 hashing algorithm. The latter also requires the value in the salt field. You will be creating two different login pages in PHP so that you can test both approaches. For the bcrypt field, use the password_hash() function; for the sha256 field, use the hash() function. Set the login form to one of the two PHP login pages. Add in some logic to handle a failed login.

3. Implement two versions of the registration PHP page. You will need to insert the received data to the users table. Before inserting the data, you will need to generate the bcrypt digest or the sha256 digest and a random salt. Set the registration form to one of the two PHP registration pages.

4. After registration, redirect to the login page. After login, redirect to the supplied home page. If the user has logged in, in the message area of the home page, display the user’s name; if the user isn’t logged in when requesting this file, display a link to the login page. This will require making use of session state in PHP to keep track of the logged in user.

5. Add a logout link to the home page. This will require clearing session state of the user information.

1. The actual password for each user in the table is mypassword. For the bcrypt hash, it has used a cost value of 12.

Create a registration and login system in Node using the supplied users json file (you will have to import it into MongoDB).

1. You have been provided with the HTML, CSS, and JavaScript for the home and login pages. Test and examine in a browser. The home page has a link to a simple API.

2. You will make use of the digest field password created from a bcrypt algorithm. You will implement the login page in Node using the passport package. This will require creating a Mongoose schema and model for the Users collection. When the user has logged in, use JWT and not sessions to maintain the logged-in status.

3. You have been provided a simple API in Node. It should only be accessible in the browser if the user has already logged in. This will require checking the token provided by the passport package.

4. Implement the logout link.

1. The actual password for each user in the table is mypassword. For the bcrypt hash, it has used a cost value of 12.