Skip to content

Commit 6d048f0

Browse files
li-xin-yili-xin-yi
committed
test
1 parent ea8ce18 commit 6d048f0

15 files changed

+598
-112
lines changed

‎app/src/main/AndroidManifest.xml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,9 @@
99
android:roundIcon="@mipmap/ic_launcher_round"
1010
android:supportsRtl="true"
1111
android:theme="@style/Theme.SQLinjectdemo">
12-
<activity android:name=".Result"></activity>
12+
<activity android:name=".AllEmployee"></activity>
13+
<activity android:name=".DataViewer" />
14+
<activity android:name=".Result" />
1315
<activity android:name=".MainActivity">
1416
<intent-filter>
1517
<action android:name="android.intent.action.MAIN" />

‎app/src/main/assets/fa-regular-400.ttf

32.9 KB
Binary file not shown.

‎app/src/main/assets/fa-solid-900.ttf

198 KB
Binary file not shown.

‎app/src/main/java/com/example/sql_inject_demo/AllEmployee.java

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
package com.example.sql_inject_demo;
2+
3+
import androidx.appcompat.app.ActionBar;
4+
import androidx.appcompat.app.AppCompatActivity;
5+
import androidx.recyclerview.widget.LinearLayoutManager;
6+
import androidx.recyclerview.widget.RecyclerView;
7+
8+
import android.database.Cursor;
9+
import android.os.Bundle;
10+
import android.view.View;
11+
import android.widget.TextView;
12+
13+
import com.google.android.material.floatingactionbutton.FloatingActionButton;
14+
15+
import java.util.ArrayList;
16+
17+
public class AllEmployee extends AppCompatActivity {
18+
19+
DBHandler dbHandler;
20+
ArrayList<Employee> employees;
21+
RecyclerView recyclerView;
22+
TextView noDataText;
23+
CustomAdapter customAdapter;
24+
FloatingActionButton returnButton;
25+
26+
@Override
27+
protected void onCreate(Bundle savedInstanceState) {
28+
super.onCreate(savedInstanceState);
29+
setContentView(R.layout.activity_all_employee);
30+
31+
ActionBar ab = getSupportActionBar();
32+
if (ab!=null)
33+
{
34+
ab.setTitle("All Employees");
35+
}
36+
37+
dbHandler = new DBHandler(AllEmployee.this,null,null,1);
38+
recyclerView = findViewById(R.id.recycleViewer);
39+
noDataText = findViewById(R.id.noDataText);
40+
returnButton = findViewById(R.id.returnButton);
41+
employees = new ArrayList<>();
42+
storeEmployees();
43+
customAdapter = new CustomAdapter(this,this,employees);
44+
recyclerView.setAdapter(customAdapter);
45+
recyclerView.setLayoutManager(new LinearLayoutManager(AllEmployee.this));
46+
returnButton.setOnClickListener(v->{finish();});
47+
}
48+
49+
protected void storeEmployees()
50+
{
51+
Cursor cursor = dbHandler.loadHandler();
52+
if (cursor.getCount()==0)
53+
{
54+
noDataText.setVisibility(View.VISIBLE);
55+
} else {
56+
while (cursor.moveToNext()){
57+
employees.add(new Employee(Integer.parseInt(cursor.getString(0)),
58+
cursor.getString(1),
59+
cursor.getString(2),
60+
cursor.getString(3),
61+
cursor.getString(4),
62+
cursor.getString(5),
63+
cursor.getString(6),
64+
cursor.getString(7),
65+
Integer.parseInt(cursor.getString(8)),
66+
cursor.getString(9)
67+
));
68+
}
69+
}
70+
}
71+
}

‎app/src/main/java/com/example/sql_inject_demo/CustomAdapter.java

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
package com.example.sql_inject_demo;
2+
3+
import android.app.Activity;
4+
import android.content.Context;
5+
import android.content.Intent;
6+
import android.graphics.Typeface;
7+
import android.view.LayoutInflater;
8+
import android.view.View;
9+
import android.view.ViewGroup;
10+
import android.view.animation.Animation;
11+
import android.view.animation.AnimationUtils;
12+
import android.widget.LinearLayout;
13+
import android.widget.TextView;
14+
15+
import androidx.annotation.NonNull;
16+
import androidx.recyclerview.widget.RecyclerView;
17+
18+
import java.text.DateFormat;
19+
import java.text.SimpleDateFormat;
20+
import java.util.ArrayList;
21+
import java.util.zip.Inflater;
22+
23+
public class CustomAdapter extends RecyclerView.Adapter<CustomAdapter.MyViewHolder> {
24+
25+
private Context context;
26+
private Activity activity;
27+
private ArrayList<Employee> employees;
28+
29+
String id_icon,phone_icon,birthday_icon,email_icon,address_icon;
30+
31+
public CustomAdapter(Context context, Activity activity, ArrayList<Employee> employees) {
32+
this.context = context;
33+
this.activity = activity;
34+
this.employees = employees;
35+
id_icon = context.getResources().getString(R.string.id_card_icon);
36+
phone_icon = context.getResources().getString(R.string.phone_icon);
37+
birthday_icon = context.getResources().getString(R.string.birthday_icon);
38+
email_icon = context.getResources().getString(R.string.email_icon);
39+
address_icon = context.getResources().getString(R.string.address_icon);
40+
}
41+
42+
@NonNull
43+
@Override
44+
public MyViewHolder onCreateViewHolder(@NonNull ViewGroup parent, int viewType) {
45+
LayoutInflater inflater = LayoutInflater.from(context);
46+
47+
View view = inflater.inflate(R.layout.activity_data_viewer,parent,false);
48+
return new MyViewHolder(view);
49+
}
50+
51+
@Override
52+
public void onBindViewHolder(@NonNull CustomAdapter.MyViewHolder holder, int position) {
53+
DateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd");
54+
holder.nameViewer.setText(employees.get(position).getName());
55+
holder.idViewer.setText(id_icon+" " +String.valueOf(employees.get(position).getId()));
56+
holder.ssnViewer.setText("SSN:"+employees.get(position).getSsn());
57+
holder.salaryViewer.setText("($"+String.valueOf(employees.get(position).getSalary())+"/yr)");
58+
holder.nicknameViwer.setText(employees.get(position).getNickname());
59+
holder.addressViewer.setText(address_icon+ " " + employees.get(position).getAddress());
60+
holder.phoneViwer.setText(phone_icon+" " + employees.get(position).getPhone());
61+
holder.emailViewer.setText(email_icon+" " + employees.get(position).getEmail());
62+
holder.birthdayViewer.setText(birthday_icon+" " + dateFormat.format(employees.get(position).getBirthday()));
63+
holder.mainLayout.setOnClickListener(v -> {
64+
Intent intent = new Intent(context, Result.class);
65+
intent.putExtra("admin",true);
66+
intent.putExtra("employee",employees.get(position));
67+
activity.startActivity(intent);
68+
});
69+
}
70+
71+
@Override
72+
public int getItemCount() {
73+
return employees.size();
74+
}
75+
76+
class MyViewHolder extends RecyclerView.ViewHolder {
77+
TextView nameViewer, idViewer, ssnViewer, salaryViewer, nicknameViwer, phoneViwer, addressViewer, emailViewer, birthdayViewer;
78+
LinearLayout mainLayout;
79+
Typeface solidFont,regularFont;
80+
81+
MyViewHolder(@NonNull View itemViewer)
82+
{
83+
super(itemViewer);
84+
85+
solidFont = Typeface.createFromAsset(context.getAssets(), "fa-solid-900.ttf" );
86+
regularFont = Typeface.createFromAsset(context.getAssets(), "fa-regular-400.ttf" );
87+
88+
nameViewer = itemViewer.findViewById(R.id.nameViewer);
89+
idViewer = itemViewer.findViewById(R.id.idViewer);
90+
ssnViewer = itemViewer.findViewById(R.id.ssnViewer);
91+
salaryViewer = itemViewer.findViewById(R.id.salaryViewer);
92+
nicknameViwer = itemViewer.findViewById(R.id.nicknameViewer);
93+
phoneViwer = itemViewer.findViewById(R.id.phoneViewer);
94+
addressViewer = itemViewer.findViewById(R.id.addressViewer);
95+
emailViewer = itemViewer.findViewById(R.id.emailViewer);
96+
birthdayViewer = itemViewer.findViewById(R.id.birthdayViewer);
97+
mainLayout = itemViewer.findViewById(R.id.mainLayout);
98+
99+
Animation translateAnimation = AnimationUtils.loadAnimation(context,R.anim.translate_anim);
100+
mainLayout.setAnimation(translateAnimation);
101+
102+
idViewer.setTypeface(regularFont);
103+
phoneViwer.setTypeface(solidFont);
104+
addressViewer.setTypeface(solidFont);
105+
birthdayViewer.setTypeface(solidFont);
106+
emailViewer.setTypeface(regularFont);
107+
}
108+
}
109+
}

‎app/src/main/java/com/example/sql_inject_demo/DBHandler.java

Lines changed: 52 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,13 @@ public class DBHandler extends SQLiteOpenHelper {
1616
private static final String TABLE_NAME = "employee";
1717

1818

19-
2019
public DBHandler(Context context, String name, SQLiteDatabase.CursorFactory factory, int version) {
2120
super(context, DB_NAME, factory, DB_VERSION);
2221
}
2322

2423
@Override
25-
public void onCreate(SQLiteDatabase db){
26-
String SQL_CREATE_TABLE = "CREATE TABLE "+ TABLE_NAME + "( ID INTEGER,"
24+
public void onCreate(SQLiteDatabase db) {
25+
String SQL_CREATE_TABLE = "CREATE TABLE " + TABLE_NAME + "( ID INTEGER,"
2726
+ "NAME TEXT,"
2827
+ "PASSWORD TEXT,"
2928
+ "SSN TEXT,"
@@ -34,47 +33,42 @@ public void onCreate(SQLiteDatabase db){
3433
+ "SALARY INTEGER,"
3534
+ "BIRTHDAY DATE)";
3635
db.execSQL(SQL_CREATE_TABLE);
37-
addHandler(db, new Employee(99999,"Admin","seedadmin","43254314",
38-
"","","","",400000,"1990-03-05"));
39-
addHandler(db, new Employee(10000,"Alice","seedalice","10211002",
40-
"","","","",20000,"2000-09-20"));
41-
addHandler(db, new Employee(20000,"Boby","seedboby","10213352",
42-
"","","","",50000,"2000-04-20"));
43-
addHandler(db, new Employee(30000,"Ryan","seedryan","32193525",
44-
"","","","",90000,"2000-04-10"));
45-
addHandler(db, new Employee(30000,"Samy","seedsamy","32111111",
46-
"","","","",40000,"2000-01-11"));
47-
addHandler(db, new Employee(40000,"Ted","seedted","24343244",
48-
"","","","",110000,"2000-11-3"));
36+
addHandler(db, new Employee(99999, "Admin", "admin", "43254314",
37+
"Ad", "(403)220-1191", "admin@hogwarts.edu", "Gryffindor House", 400000, "1990-03-05"));
38+
addHandler(db, new Employee(10000, "Alice", "alice", "10211002",
39+
"Ali", "(400)210-2112", "alice@hogwarts.edu", "Gryffindor House", 20000, "2000-09-20"));
40+
addHandler(db, new Employee(20000, "Boby", "boby", "10213352",
41+
"Bob", "(404)789-2313", "boby@hogwarts.edu", "Hufflepuff House", 50000, "2000-04-20"));
42+
addHandler(db, new Employee(30000, "Ryan", "ryan", "32193525",
43+
"Ryanny", "(210)096-3287", "ryan@hogwarts.edu", "Ravenclaw House", 90000, "2000-04-10"));
44+
addHandler(db, new Employee(40000, "Samy", "samy", "32111111",
45+
"Sam", "(450)218-8876", "samy@hogwarts.edu", "Slytherin", 40000, "2000-01-11"));
46+
addHandler(db, new Employee(50000, "Ted", "ted", "24343244",
47+
"Teddy", "(208)222-8712", "ted@hogwarts.edu", "Azkaban", 110000, "2000-11-3"));
4948
}
5049

5150
@Override
52-
public void onUpgrade(SQLiteDatabase db, int i, int i1)
53-
{
54-
db.execSQL("DROP TABLE IF EXISTS "+ TABLE_NAME);
51+
public void onUpgrade(SQLiteDatabase db, int i, int i1) {
52+
db.execSQL("DROP TABLE IF EXISTS " + TABLE_NAME);
5553
onCreate(db);
5654
}
5755

58-
public Cursor loadHandler()
59-
{
56+
public Cursor loadHandler() {
6057
String query = "SELECT * FROM " + TABLE_NAME;
6158
Cursor cursor = null;
62-
SQLiteDatabase db = this.getWritableDatabase();
63-
if (db != null)
64-
{
65-
cursor = db.rawQuery(query,null);
66-
db.close();
59+
SQLiteDatabase db = this.getReadableDatabase();
60+
if (db != null) {
61+
cursor = db.rawQuery(query, null);
62+
// db.close();
6763
}
6864

6965
return cursor;
7066
}
7167

72-
public void addHandler(SQLiteDatabase db, Employee employee)
73-
{
68+
public void addHandler(SQLiteDatabase db, Employee employee) {
7469
DateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd");
7570
ContentValues values = new ContentValues();
76-
if (db!=null)
77-
{
71+
if (db != null) {
7872
values.put("ID", employee.getId());
7973
values.put("NAME", employee.getName());
8074
values.put("PASSWORD", employee.getPassword());
@@ -89,13 +83,12 @@ public void addHandler(SQLiteDatabase db, Employee employee)
8983
}
9084
}
9185

92-
public Employee findHandler(String username, String password)
93-
{
94-
String query = "SELECT * FROM " + TABLE_NAME + " WHERE NAME='" + username + "' AND PASSWORD='" + password+"'";
95-
SQLiteDatabase db = this.getWritableDatabase();
96-
Employee employee= null;
97-
Cursor cursor = db.rawQuery(query,null);
98-
if (cursor!=null && cursor.getCount()>0 && cursor.moveToFirst()) {
86+
public Employee findHandler(String username, String password) {
87+
String query = "SELECT * FROM " + TABLE_NAME + " WHERE NAME='" + username + "' AND PASSWORD='" + password + "'";
88+
SQLiteDatabase db = this.getReadableDatabase();
89+
Employee employee = null;
90+
Cursor cursor = db.rawQuery(query, null);
91+
if (cursor != null && cursor.getCount() > 0 && cursor.moveToFirst()) {
9992
employee = new Employee(Integer.parseInt(cursor.getString(0)),
10093
cursor.getString(1),
10194
cursor.getString(2),
@@ -106,16 +99,16 @@ public Employee findHandler(String username, String password)
10699
cursor.getString(7),
107100
Integer.parseInt(cursor.getString(8)),
108101
cursor.getString(9)
109-
);
102+
);
110103
cursor.close();
111104
}
112105
db.close();
113106
return employee;
114107
}
115108

116-
public boolean updateHandler(Employee employee)
117-
{
118-
String UPDATE_SQL_COMMAND = String.format("UPDATE %s SET NICKNAME=%s, EMAIL=%s, ADDRESS=%s, PASSWORD=%s, PHONE=%s WHERE ID=%s RETURNING *",
109+
public void partialUpdateHandler(Employee employee) {
110+
// invoked by user, update some optional fields
111+
String UPDATE_SQL_COMMAND = String.format("UPDATE %s SET NICKNAME='%s', EMAIL='%s', ADDRESS='%s', PASSWORD='%s', PHONE='%s' WHERE ID=%s",
119112
TABLE_NAME,
120113
employee.getNickname(),
121114
employee.getEmail(),
@@ -124,9 +117,25 @@ public boolean updateHandler(Employee employee)
124117
employee.getPhone(),
125118
employee.getId());
126119
SQLiteDatabase db = this.getWritableDatabase();
127-
Cursor cursor = db.rawQuery(UPDATE_SQL_COMMAND,null);
128-
cursor.close();
129-
return cursor.getCount()==1;
120+
db.execSQL(UPDATE_SQL_COMMAND);
121+
}
122+
123+
public boolean fullUpdateHandler(Employee employee)
124+
{
125+
// invoked by admin, update all fields except ID
126+
DateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd");
127+
SQLiteDatabase db = this.getWritableDatabase();
128+
ContentValues values = new ContentValues();
129+
values.put("NAME", employee.getName());
130+
values.put("PASSWORD", employee.getPassword());
131+
values.put("SSN", employee.getSsn());
132+
values.put("NICKNAME", employee.getNickname());
133+
values.put("PHONE", employee.getPhone());
134+
values.put("SALARY", employee.getSalary());
135+
values.put("ADDRESS", employee.getAddress());
136+
values.put("EMAIL", employee.getEmail());
137+
values.put("BIRTHDAY", dateFormat.format(employee.getBirthday()));
138+
return -1!=db.update(TABLE_NAME,values,"ID=?", new String[]{String.valueOf(employee.getId())});
130139
}
131140

132141
}

‎app/src/main/java/com/example/sql_inject_demo/DataViewer.java

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package com.example.sql_inject_demo;
2+
3+
import androidx.appcompat.app.AppCompatActivity;
4+
5+
import android.os.Bundle;
6+
7+
public class DataViewer extends AppCompatActivity {
8+
9+
@Override
10+
protected void onCreate(Bundle savedInstanceState) {
11+
super.onCreate(savedInstanceState);
12+
setContentView(R.layout.activity_data_viewer);
13+
}
14+
}

‎app/src/main/java/com/example/sql_inject_demo/Employee.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
package com.example.sql_inject_demo;
22

3+
import java.io.Serializable;
34
import java.text.DateFormat;
45
import java.text.SimpleDateFormat;
56
import java.util.Date;
67

78

8-
public class Employee {
9+
public class Employee implements Serializable {
910
private String name, password, ssn, nickname, phone, email, address;
1011
private int salary,id;
1112
private Date birthday;

0 commit comments

Comments
 (0)