Demonstration

Return to database2 manual

These tables are available for public testing. Some tables are available for public edit, as well!

If you encounter offensive or illegal content on this page please send a mail to soletan@nihilum.de requesting its proper modification to exclude concerned parts of content.

check definition in line 6: no enumeration elements

at 4000@/var/www/localhost/htdocs/wiki.nihilum.de/lib/plugins/database2/database2.php

Next there is a read-only view on previous table:

DB interaction failed: Failed to count record! (line 1559)
at 817@/var/www/localhost/htdocs/wiki.nihilum.de/lib/plugins/database2/database2.php

The following two tables are hosted in a locally driven MySQL server. Note: There is a hidden filter applied, thus some available records might be missing in this list.

Login Name  Password  Is Admin? 
1 Guest hidden
2 dannno hidden
2 records

This second table is using new column type related to link in a single record from previous table.

Surname  Given Name  Employed Sínce  Account  Superíor 
0 records

Take a look at the page's source to see how to embed tables like these.

Is it secure?

You might asking yourself whether or not this demonstration page is properly protected from SQL injection attacks as it allows unauthenticated users to update records in databases. Well, database2 is separating SQL code and queried data using prepared statements with input parameter markers bound with user-provided data on executing the statements. Due to this separation user-provided data cannot adjust used SQL statements.

By introducing support for new option aliasing to declare arbitrary SQL terms for listing computed data next to column data everyone capable of writing a page might use this feature to inject malicious SQL code. Due to introducing such a risk it is disabled in configuration by default requiring explicit activation.

If users or guests are enabled to write content including wiki markup (like comments) it's possible to enter database2 tags. This introduces severe vulnerability.


Don't use plugins enabling unauthenticated visitors of your site to enter wiki markup in combination with this plugin.

Alternatively you might upgrade to release 0.4.0 and use introduced page filter to enable database2 tag on selected pages of your Wiki, only!

Back to top
software/database2/demo.txt · Last modified: 2009/11/18 10:24 by soletan