<reponame>anushkadixit1708/Projects_CSE<!DOCTYPE html>
<html>
<head>
	<title>SQL Injection Level 1</title>
	<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css" integrity="949d1u22cbffbrarjh182eig55721odj" crossorigin="anonymous">
</head>
<body>
	 <div style="background-color:#c9c9c9;padding:15px;">
      <button class="btn btn-primary"  type="button" name="homeButton" onclick="location.href='../homepage.html';">Home Page</button>
      <button class="btn btn-primary" type="button" name="mainButton" onclick="location.href='sqlmainpage.html';">Main Page</button>
	</div>

	<div align="center">
	<form action="<?php $_SERVER['PHP_SELF']; ?>" method="post" >
		<p>John -> Doe</p>
		First name : <input type="text" name="firstname">
		<input type="submit" name="submit" value="Submit">
	</form>
	</div><hr>


<?php 
	$servername = "localhost";
	$username = "root";
	$password = "";
	$db = "1ccb8097d0e9ce9f154608be60224c7c";

	// Create connection
	$conn = mysqli_connect($servername,$username,$password,$db);

	// Check connection
	if (!$conn) {
    	die("Connection failed: " . mysqli_connect_error());
	} 
	//echo "Connected successfully";
	
	if(isset($_POST["submit"])){
		$firstname = $_POST["firstname"];
		$sql = "SELECT lastname FROM users WHERE firstname='$firstname'";//String
		$result = mysqli_query($conn,$sql);
		
		if (mysqli_num_rows($result) > 0) {
        // output data of each row
    		while($row = mysqli_fetch_assoc($result)) {
				$temp = $row["lastname"];
       			echo "<p align=center >$temp</p>";
				echo "<hr>";
    		}
		} else {
    		echo "<p align=center >0 results!</p>";
		}
	}
	
 ?>
</body>
</html>