SQL injection in an ALTER statement [on hold]

I am new to stack– apologies if this isn’t allowed, I’m reposting this question here because this seems to be a more active community.

Let’s say you have a Java app which has a query which can unlock/reset passwords for users like:

ALTER USER " + iD_Of_User.toUpperCase() + " IDENTIFIED BY " + password_Of_User + " ACCOUNT UNLOCK 

Where iD_Of_User and password_Of_User definitely come in directly from an HTTP request. Basically this.

I get an error when I try to use a PreparedStatement object to parameterize the dynamic values… I guess PreparedStatement’s parameters can only be used for data values? And the ALTER query here is not using the values that way.

I don’t think input validation is even possible here– maybe on the iD_Of_User value, but almost certainly not on the password_Of_User value (which is sometimes used as a password reset– so it’s only restrictions are the Oracle 12c password standards).

Any help were would be greatly appreciated. I reviewed this post, but it didn’t give me a good solution. I’m hoping someone knows of a good way to do password resets/account unlocks in Oracle which doesn’t open the app up to SQL injection.

Is this statement of P = NP in Agda correct?

Looking for a completely formal and self-contained statement of P = NP in type theory, I stumbled upon this short Agda formalization (a cleaned up version is reproduced below).

The statement here does seem to express the problem correctly but I’m not entirely sure as the code is not well-commented. So my question is: is this an accurate statement of P = NP and if not how would one fix it?

 open import Data.Nat                              using    (ℕ; suc; zero; _+_; _*_; _≤_; _^_) open import Data.Bool                             using    (Bool; true; false; if_then_else_; _∨_) open import Data.List                             using    (List; _∷_; []; length) open import Data.Vec                              using    (Vec; _∷_; []) open import Data.Product                          using    (Σ-syntax; _,_) open import Data.Sum                              using    (_⊎_; inj₁; inj₂) open import Data.Empty                            using    (⊥) open import Relation.Binary.PropositionalEquality using    (_≡_; refl)  iterate : {A : Set} → ℕ → A → (A → A) → A iterate zero    z s = z iterate (suc n) z s = s (iterate n z s)  is-poly : (ℕ → ℕ) → Set is-poly f = Σ[ m ∈ ℕ ] ((n : ℕ) → f n ≤ 2 ^ m)  is-inj₂ : {A B : Set} → A ⊎ B → Bool is-inj₂ (inj₁  _) = false is-inj₂ (inj₂ _) = true  data fn : ℕ → Set where     fz : {n : ℕ} → fn (suc n)     fs : {n : ℕ} → fn n → fn (suc n)  ref : {A : Set} {n : ℕ} → fn n → Vec A n → A ref fz (a ∷ _) = a ref (fs m) (_ ∷ rest) = ref m rest  subs : {A : Set} {n : ℕ} → fn n → A → Vec A n → Vec A n subs fz a (_ ∷ rest) = a ∷ rest subs (fs m) a (b ∷ rest) = b ∷ subs m a rest  replicate : {A : Set} → (n : ℕ) → A → Vec A n replicate zero a = [] replicate (suc n) a = a ∷ replicate n a  data command (stacks : ℕ) (states : ℕ) : Set where   push   : fn stacks → Bool → fn states → command stacks states   pop    : fn stacks → fn states → fn states → fn states          → command stacks states   return : Bool → command stacks states  record machine : Set where   field     stacks : ℕ     states : ℕ     commands : Vec (command stacks states) states     initial-command : fn states  command-mach : machine → Set command-mach m = command (machine.stacks m) (machine.states m)  record state (m : machine) : Set where   constructor mkState   field     stacks : Vec (List Bool) (machine.stacks m)     current : fn (machine.states m)  step : (m : machine) → state m → (state m) ⊎ Bool exec : {m : machine} → command-mach m → state m → (state m) ⊎ Bool  step m s = exec (ref (state.current s) (machine.commands m)) s exec (return b) _ = inj₂ b exec (push i b c) s =   let     prev-stack : List Bool     prev-stack = ref i (state.stacks s)   in     inj₁ (mkState (subs i (b ∷ prev-stack) (state.stacks s)) c)  exec (pop i ct cf ce) s with ref i (state.stacks s) ... | []           = inj₁ (mkState (state.stacks s) ce) ... | true  ∷ rest = inj₁ (mkState (subs i rest (state.stacks s)) ct) ... | false ∷ rest = inj₁ (mkState (subs i rest (state.stacks s)) cf)  step-or-halted : (m : machine) → (state m) ⊎ Bool → (state m) ⊎ Bool step-or-halted m (inj₂ b) = inj₂ b step-or-halted m (inj₁ s) = step m s  nsteps : {m : machine} → ℕ → state m → (state m) ⊎ Bool nsteps {m} n s = iterate n (inj₁ s) (step-or-halted m)  initial-state : (m : machine) → List Bool → state m initial-state m l =   mkState (replicate (machine.stacks m) l) (machine.initial-command m)  record poly-time-machine : Set where   inductive   field     m : machine     runtime : ℕ → ℕ     poly : is-poly runtime     is-runtime : (l : List Bool)                → (is-inj₂ (nsteps (runtime (length l)) (initial-state m l))) ≡ true  get-inj₂ : {A B : Set} → (e : A ⊎ B) → is-inj₂ e ≡ true → B get-inj₂ (inj₁ x) () get-inj₂ (inj₂ x) _ = x  run-poly-time-machine : poly-time-machine → List Bool → Bool run-poly-time-machine m inp = get-inj₂ _ (poly-time-machine.is-runtime m inp)  np-machine : Set np-machine = poly-time-machine  search : ℕ → poly-time-machine → List Bool → Bool search zero    m inp = run-poly-time-machine m inp search (suc n) m inp = search n m (false ∷ inp) ∨ search n m (true ∷ inp)  run-np-machine : np-machine → List Bool → Bool run-np-machine m inp = search (length inp) m inp  P=NP : Set P=NP =   (m-np : np-machine) →     Σ[ m-p ∈ poly-time-machine ]       (((inp : List Bool) → run-poly-time-machine m-p inp ≡ run-np-machine m-np inp)) ``` 

Nested select statement work procedure

I was wondering how nested select statement works.

Let me be clear with an example(with an academic example). According to Database system concept of Silberschatz I am using an university database. And here is link to schema.

If I want to “Find the enrolment of each section that was offered in Fall 2017” one way to query database is :


select    course_id,    sec_id,   (select         count(ID)     from         takes     where         takes.year = section.year and        takes.semester = section.semester and         takes.course_id = section.course_id and         takes.sec_id = section.sec_id) from      section  where      semester = 'Fall' and year = 2017; 

I want to know how inner select statement matches rows with course_id and sec_id.

Thanks

How does this SQLi statement work?

Hey i’m trying the hacker101 CTF’s im still pretty new at this stuff

The CTF answer to the flag i’m trying to understand is https://github.com/testerting/hacker101-ctf/tree/master/micro-cms_v2/flag0

The important part of the error you get when you put a single ' in the username field if cur.execute('SELECT password FROM admins WHERE username=\'%s\'' % request.form['username'].replace('%', '%%')) == 0:

The solution to the flag is to input this into a username field

' UNION SELECT '123' AS password# 

This is the statement I don’t understand. I googled “SQL AS keyword” and I got something saying something along these lines, “The as keyword is a alias for a column or table” But '123' is a string, right? I got then got fustrated and moved on to the other thing I don’t understand about the statement, the # at the end of password. I then also googled the “sql pound symbol” and I got it was referencing a temp table, which again, I don’t really get..

Thanks!

Why python script stops executing the statement of loop but the process itself is alive?

i am running face recognition python script on Ubutnu 18.04 as a daemon which takes pictures from another server with ssh request and performs operations on them . i have this code in python script which is always running but the statement of while loop stops being executed . the process itself is alive

While true:  ssh request to another server to recieve pictures   time.sleep(1) 

i check the directory of another server and the pictures are present there

Problema al verificar valores SQL con WHEN statement

tengo este problema en SQL Server 2008. He creado una tabla para ingresar datos y que luego el usuario vea los que planea ingresar (en una carga masiva con archivo csv).

CREATE TABLE dbo.temp_horario2 ( idTempHorario INT IDENTITY(1,1) NOT NULL, idEmpleado VARCHAR(500), nroDocumento VARCHAR(500), dia VARCHAR(500), idHorario VARCHAR(500), idUsuario INT ); 

En principio varias de esas columnas no deben ser VARCHAR, sino INT, pero estan VARCHAR para que luego en una vista de tabla temporal el usuario vea los datos que ingreso y se le indique cuales están mal. El problema es al comparar los valores insertados de esta tabla con las tablas originales, ya que esos si son INT. Al probar estos datos insertados:

INSERT INTO dbo.temp_horario2 (idEmpleado, nroDocumento, dia, idHorario, idUsuario) VALUES (12, 3224, 1, 1, 1); INSERT INTO dbo.temp_horario2 (idEmpleado, nroDocumento, dia, idHorario, idUsuario) VALUES (2123, 10782295, 1, 1, 1); INSERT INTO dbo.temp_horario2 (idEmpleado, nroDocumento, dia, idHorario, idUsuario) VALUES (234324234, 3232495, 34, 2, 34); INSERT INTO dbo.temp_horario2 (idEmpleado, nroDocumento, dia, idHorario, idUsuario) VALUES ('asdf', 2, 'dsf', 'dos', 34); 

Me salen estos errores:

Msg 245, Level 16, State 1, Line 1 Error de conversión al convertir el valor varchar ‘asdf’ al tipo de datos smallint.

o

La conversión del valor varchar ‘234324234’ ha desbordado una columna INT2. Utilice una columna de tipo integer mayor.

Este es el query con columnas que me sirven para validar los datos.

SELECT th.idTempHorario, th.idEmpleado, th.nroDocumento, th.dia, th.idHorario, th.idUsuario, CASE     WHEN th.idEmpleado IN(SELECT rhem.idEmpleado FROM rrhh.dbo.Empleado AS rhem) THEN 1     ELSE 0 END AS validacionIdEmpleado, CASE     WHEN th.nroDocumento IN(SELECT rhem.numTipoDocuIdent FROM rrhh.dbo.Empleado AS rhem) THEN 1     ELSE 0 END AS validacionNroDocumento, CASE     WHEN th.dia IN(SELECT gd.idDia FROM General.dbo.dia AS gd) THEN 1     ELSE 0 END AS validacionDia, CASE     WHEN th.idHorario IN(SELECT rhas.idHorarioAdmin FROM rrhh.asistencia.horarioAdmin AS rhas) THEN 1     ELSE 0 END AS validacionIdHorario FROM database.dbo.temp_horario2 AS th 

Showing unable to locate libmysql-java after sudo apt-get install libmysql-java statement

Even I have tried java-mysql but also showing this Reading package lists… Done Building dependency tree
Reading state information… Done E: Unable to locate package java-mysql

libmysql-java–

Reading package lists… Done Building dependency tree
Reading state information… Done E: Unable to locate package libmysql-java

I have Just downloaded the package and now I don’t know where to place it.

SharePoint Column Conditional Formatting – Applying CSS classes to a date field using a nested IF statement

Apologies, I am relatively new to SharePoint/JSON, So forgive me if I am not seeing the obvious. I would be INCREDIBLY grateful if someone would help.

I would like to apply conditional formatting to a date field using a nested IF statement.

IF the current field is blank, then set the CSS class to ‘blocked’. However, if the current field is populated, run a second IF: IF the current field is more than 1 year before today, then set the CSS class to ‘blocked’, however if the current field is within the last year, set the CSS class to ‘good’.

I have ran the following, without success. No formatting is applied whatsoever.

 {    "$  schema": "https://developer.microsoft.com/json-schemas/sp/v2/column-formatting.schema.json",  "elmType": "div",  "attributes": {  "class": "=if(toString(@currentField)=='', 'sp-field-severity--blocked', if([@currentField]+31104000000 < @now,'sp-field-severity--blocked', 'sp-field-severity--good'))"   },  "txtContent": "@currentField"  } 

HOWEVER, when I split the conditions into two, they work independently.

  1. =IF empty, blocked, good.
{   "$  schema": "https://developer.microsoft.com/json-schemas/sp/column-formatting.schema.json",   "elmType": "div",   "attributes": {     "class": "=if(toString(@currentField)=='','sp-field-severity--blocked', 'sp-field-severity--good')"   },   "txtContent": "@currentField" } 
  1. =IF exceeds 1 year, blocked, good.
{   "$  schema": "https://developer.microsoft.com/json-schemas/sp/v2/column-formatting.schema.json",   "elmType": "div",   "attributes": {     "class": "=if(@currentField+31104000000 < @now, 'sp-field-severity--blocked', 'sp-field-severity--good')"   },   "txtContent": "@currentField" } 

My next step would be to add the corresponding CSS class icon into the field.