This PHP application intentionally demonstrates common web vulnerabilities for educational comparison with the Ur/Web secure implementation.
This code is intentionally vulnerable. Do NOT use in production. For educational use only — Secure Systems coursework.
| File | Purpose |
|---|---|
index.php |
Candidate list and voting form |
vote.php |
Vote processing (VULNERABLE) |
result.php |
Results display (VULNERABLE) |
db.php |
MySQL database |
| Vulnerability | Location | How to Test |
|---|---|---|
| SQL Injection | vote.php line 7 |
Send 1 OR 1=1; DROP TABLE-- |
| Stored XSS | results.php line 10 |
Insert <script>alert(1)</script> as name |
| CSRF | vote.php |
Submit from external hidden form |
See the secure Ur/Web version: https://github.com/bhimsen145/urweb-voting-system