Today: Security demo with SQL Injection! A bit of background Websites (Web 111) HTML, very brief overview Python (CS111): Used for scripts on servers and such a lot Where script execution time doesn't matter much Generating websites: Lots of ways to do this My old way: Apache + mod_python Today: flask Either way, we generate the website This gives us the chance to run whatever we like SQL: (CS226) Relational Database: Collection of related tables General query form: Select From Where SQL Injection: Basically, we need to get a bit of our own SQL to run General form: End quotation, add more, resume quotation Have to avoid syntax errors Login page demo Cookies: Used to remember some data on a per-user basis Distributes storage over users Might be hard for us to track them anyway Some people clear these Cookie editing We have the cookie, why can't we change it? Stats page demo