# CSPJ Application

## Services

- 3331: Apache + ModSecurity
- 3332: Suricata
- 3333: Backend server
- 3334: Python backend server
- 3335: PostgreSQL

backend-for-frontend server

!remember to set the environment variables
!include this in the setup instructions
!should we use a .env file and let the user set the variables?

PGHOST=localhost
PGPORT=5432
PGDATABASE=asdfdb
PGUSER=asdfuser
PGPASSWORD=asdfpassword

## Server

!only listening on localhost is supported. DO NOT run this on a public ip.

- `/health`
- `/health-db`
- `/setup-demo-db`
- `/nuke-db`
- `/fetch-all-users`

### SQL Injection

Use `' OR 1=1; --`  
Use `tohyouxuan@gmail.com' UNION SELECT id, email, password FROM users WHERE email = 'tohyouxuan@gmail.com'; --`

- `/unsecure-register-sql`
- `/secure-register-sql`
- `/unsecure-login-sql`
- `/secure-login-sql`

#### 1. Parameterization of Queries

Used `pool.Query()` with a parameterized query, instead of dynamically constructing the SQL query by directly inserting the user input.  
Parameterized queries separate the SQL code from the data, so user input is never directly put into the query's structure. Placeholders are used instead, and the data is passed as parameters. The DB will treat them as data, not executable code.

## ZAP

Content-Type: application/json

{
"email": "tohyouxuan@gmail.com",
"password": "testpassword"
}