Restructured the baseline to remove extra src/main directory structure. Added eclipes project file

git-svn-id: http://webgoat.googlecode.com/svn/branches/webgoat-6.0@485 4033779f-a91e-0410-96ef-6bf7bf53c507

java/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java

@@ -0,0 +1,325 @@
+
+package org.owasp.webgoat.lessons.CrossSiteScripting;
+
+import java.io.BufferedReader;
+import java.io.FileReader;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import org.apache.ecs.ElementContainer;
+import org.apache.ecs.StringElement;
+import org.apache.ecs.html.Body;
+import org.apache.ecs.html.Head;
+import org.apache.ecs.html.Html;
+import org.apache.ecs.html.Title;
+import org.owasp.webgoat.lessons.Category;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.DeleteProfile;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.GoatHillsFinancial;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.LessonAction;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.ListStaff;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.Login;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.Logout;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.SearchStaff;
+import org.owasp.webgoat.session.ParameterNotFoundException;
+import org.owasp.webgoat.session.UnauthenticatedException;
+import org.owasp.webgoat.session.UnauthorizedException;
+import org.owasp.webgoat.session.ValidationException;
+import org.owasp.webgoat.session.WebSession;
+import org.owasp.webgoat.util.HtmlEncoder;
+
+
+/**
+ * /*******************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at code.google.com, a repository for free software
+ * projects.
+ * 
+ * For details, please see http://code.google.com/p/webgoat/
+ * 
+ */
+public class CrossSiteScripting extends GoatHillsFinancial
+{
+	private final static Integer DEFAULT_RANKING = new Integer(100);
+
+	public final static String STAGE1 = "Stored XSS";
+
+	public final static String STAGE2 = "Block Stored XSS using Input Validation";
+
+	public final static String STAGE3 = "Stored XSS Revisited";
+
+	public final static String STAGE4 = "Block Stored XSS using Output Encoding";
+
+	public final static String STAGE5 = "Reflected XSS";
+
+	public final static String STAGE6 = "Block Reflected XSS";
+
+	protected void registerActions(String className)
+	{
+		registerAction(new ListStaff(this, className, LISTSTAFF_ACTION));
+		registerAction(new SearchStaff(this, className, SEARCHSTAFF_ACTION));
+		registerAction(new ViewProfile(this, className, VIEWPROFILE_ACTION));
+		registerAction(new EditProfile(this, className, EDITPROFILE_ACTION));
+		registerAction(new EditProfile(this, className, CREATEPROFILE_ACTION));
+
+		// These actions are special in that they chain to other actions.
+		registerAction(new Login(this, className, LOGIN_ACTION, getAction(LISTSTAFF_ACTION)));
+		registerAction(new Logout(this, className, LOGOUT_ACTION, getAction(LOGIN_ACTION)));
+		registerAction(new FindProfile(this, className, FINDPROFILE_ACTION, getAction(VIEWPROFILE_ACTION)));
+		registerAction(new UpdateProfile(this, className, UPDATEPROFILE_ACTION, getAction(VIEWPROFILE_ACTION)));
+		registerAction(new DeleteProfile(this, className, DELETEPROFILE_ACTION, getAction(LISTSTAFF_ACTION)));
+	}
+
+	/**
+	 * Gets the category attribute of the CrossSiteScripting object
+	 * 
+	 * @return The category value
+	 */
+	public Category getDefaultCategory()
+	{
+		return Category.XSS;
+	}
+
+	public String getLessonSolutionFileName(WebSession s)
+	{
+		String solutionFileName = null;
+		String stage = getStage(s);
+		solutionFileName = "/lesson_solutions/Lab XSS/Lab " + stage + ".html";
+		return solutionFileName;
+	}
+
+	@Override
+	public String getSolution(WebSession s)
+	{
+		String src = null;
+
+		try
+		{
+			// System.out.println("Solution: " + getLessonSolutionFileName(s));
+			src = readFromFile(new BufferedReader(new FileReader(s.getWebResource(getLessonSolutionFileName(s)))),
+								false);
+		} catch (IOException e)
+		{
+			s.setMessage("Could not find the solution file");
+			src = ("Could not find the solution file");
+		}
+
+		return src;
+	}
+
+	/**
+	 * Gets the hints attribute of the DirectoryScreen object
+	 * 
+	 * @return The hints value
+	 */
+	protected List<String> getHints(WebSession s)
+	{
+		List<String> hints = new ArrayList<String>();
+
+		// Stage 1
+		hints.add("Stage1: You can put HTML tags in form input fields.");
+		hints.add("Stage1: Bury a SCRIPT tag in the field to attack anyone who reads it.");
+		hints
+				.add("Stage1: Enter this: &lt;script language=\"javascript\" type=\"text/javascript\"&gt;alert(\"Ha Ha Ha\");&lt;/script&gt; in message fields.");
+		hints.add("Stage1: Enter this: &lt;script&gt;alert(\"document.cookie\");&lt;/script&gt; in message fields.");
+
+		// Stage 2
+		hints.add("Stage2: Many scripts rely on the use of special characters such as: &lt;");
+		hints
+				.add("Stage2: Allowing only a certain set of characters (positive filtering) is preferred to blocking a set of characters (negative filtering).");
+		hints.add("Stage2: The java.util.regex package is useful for filtering string values.");
+
+		// Stage 3
+		hints
+				.add("Stage3: Browsers recognize and decode HTML entity encoded content after parsing and interpretting HTML tags.");
+		hints.add("Stage3: An HTML entity encoder is provided in the ParameterParser class.");
+
+		// Stage 4
+		hints
+				.add("Stage4: Examine content served in response to form submissions looking for data taken from the form.");
+		hints.add("Stage4: There is a class called HtmlEncoder in org.owasp.webgoat.util");
+		// Stage 5
+		hints
+				.add("Stage5: Validate early.  Consider: out.println(\"Order for \" + request.getParameter(\"product\") + \" being processed...\");");
+
+		return hints;
+	}
+
+	/**
+	 * Gets the instructions attribute of the ParameterInjection object
+	 * 
+	 * @return The instructions value
+	 */
+	public String getInstructions(WebSession s)
+	{
+		String instructions = "";
+
+		if (!getLessonTracker(s).getCompleted())
+		{
+			String stage = getStage(s);
+			if (STAGE1.equals(stage))
+			{
+				instructions = "Stage 1: Execute a Stored Cross Site Scripting (XSS) attack.<br>"
+						+ "As 'Tom', execute a Stored XSS attack against the Street field on the Edit Profile page.  "
+						+ "Verify that 'Jerry' is affected by the attack. <br/>The passwords for the accounts are the lower-case " 
+						+ "versions of their given names (e.g. the password for Tom Cat is \"tom\").";
+			}
+			else if (STAGE2.equals(stage))
+			{
+				instructions = "Stage 2: Block Stored XSS using Input Validation.<br><br>"
+						+ "<b><font color=blue> THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT</font></b><br/><br/>"
+						+ "Implement a fix to block the stored XSS before it can be written to the database. "
+						+ "Repeat stage 1 as 'Eric' with 'David' as the manager.  Verify that 'David' is not affected by the attack.";
+			}
+			else if (STAGE3.equals(stage))
+			{
+				instructions = "Stage 3: Execute a previously Stored Cross Site Scripting (XSS) attack.<br>"
+						+ "The 'Bruce' employee profile is pre-loaded with a stored XSS attack. "
+						+ "Verify that 'David' is affected by the attack even though the fix from stage 2 is in place.";
+			}
+			else if (STAGE4.equals(stage))
+			{
+				instructions = "Stage 4: Block Stored XSS using Output Encoding.<br><br>"
+						+ "<b><font color=blue> THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT</font></b><br/><br/>"
+						+ "Implement a fix to block XSS after it is read from the database. "
+						+ "Repeat stage 3. Verify that 'David' is not affected by Bruce's profile attack.";
+			}
+			else if (STAGE5.equals(stage))
+			{
+				instructions = "Stage 5: Execute a Reflected XSS attack.<br>"
+						+ "Use a vulnerability on the Search Staff page to craft a URL containing a reflected XSS attack.  "
+						+ "Verify that another employee using the link is affected by the attack.";
+			}
+			else if (STAGE6.equals(stage))
+			{
+				instructions = "Stage 6: Block Reflected XSS using Input Validation.<br><br>"
+						+ "<b><font color=blue> THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT</font></b><br/><br/>"
+						+ "Implement a fix to block this reflected XSS attack. "
+						+ "Repeat step 5.  Verify that the attack URL is no longer effective.";
+			}
+		}
+
+		return instructions;
+
+	}
+
+	@Override
+	public String[] getStages()
+	{
+		if (getWebgoatContext().isCodingExercises())
+			return new String[] { STAGE1, STAGE2, STAGE3, STAGE4, STAGE5, STAGE6 };
+		return new String[] { STAGE1, STAGE3, STAGE5 };
+	}
+
+	public void handleRequest(WebSession s)
+	{
+		if (s.getLessonSession(this) == null) s.openLessonSession(this);
+
+		String requestedActionName = null;
+		try
+		{
+			requestedActionName = s.getParser().getStringParameter("action");
+		} catch (ParameterNotFoundException pnfe)
+		{
+			// Let them eat login page.
+			requestedActionName = LOGIN_ACTION;
+		}
+
+		if (requestedActionName != null)
+		{
+			try
+			{
+				LessonAction action = getAction(requestedActionName);
+
+				if (action != null)
+				{
+					if (!action.requiresAuthentication() || action.isAuthenticated(s))
+					{
+						action.handleRequest(s);
+						// setCurrentAction(s, action.getNextPage(s));
+					}
+				}
+				else
+				{
+					setCurrentAction(s, ERROR_ACTION);
+				}
+			} catch (ParameterNotFoundException pnfe)
+			{
+				// System.out.println("Missing parameter");
+				pnfe.printStackTrace();
+				setCurrentAction(s, ERROR_ACTION);
+			} catch (ValidationException ve)
+			{
+				// System.out.println("Validation failed");
+				ve.printStackTrace();
+				setCurrentAction(s, ERROR_ACTION);
+			} catch (UnauthenticatedException ue)
+			{
+				s.setMessage("Login failed");
+				// System.out.println("Authentication failure");
+				ue.printStackTrace();
+			} catch (UnauthorizedException ue2)
+			{
+				s.setMessage("You are not authorized to perform this function");
+				// System.out.println("Authorization failure");
+				ue2.printStackTrace();
+			} catch (Exception e)
+			{
+				// All other errors send the user to the generic error page
+				// System.out.println("handleRequest() error");
+				e.printStackTrace();
+				setCurrentAction(s, ERROR_ACTION);
+			}
+		}
+
+		// All this does for this lesson is ensure that a non-null content exists.
+		setContent(new ElementContainer());
+	}
+
+	protected Integer getDefaultRanking()
+	{
+		return DEFAULT_RANKING;
+	}
+
+	/**
+	 * Gets the title attribute of the CrossSiteScripting object
+	 * 
+	 * @return The title value
+	 */
+	public String getTitle()
+	{
+		return "LAB: Cross Site Scripting";
+	}
+
+	public String htmlEncode(WebSession s, String text)
+	{
+		if (STAGE4.equals(getStage(s)) && text.indexOf("<script>") > -1 && text.indexOf("alert") > -1
+				&& text.indexOf("</script>") > -1)
+		{
+			setStageComplete(s, STAGE4);
+			s.setMessage("Welcome to stage 5 -- exploiting the data layer");
+		}
+
+		return HtmlEncoder.encode(text);
+	}
+
+}

java/org/owasp/webgoat/lessons/CrossSiteScripting/EditProfile.java

@@ -0,0 +1,161 @@
+
+package org.owasp.webgoat.lessons.CrossSiteScripting;
+
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.DefaultLessonAction;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.GoatHillsFinancial;
+import org.owasp.webgoat.session.Employee;
+import org.owasp.webgoat.session.ParameterNotFoundException;
+import org.owasp.webgoat.session.UnauthenticatedException;
+import org.owasp.webgoat.session.UnauthorizedException;
+import org.owasp.webgoat.session.WebSession;
+
+
+/***************************************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at code.google.com, a repository for free software
+ * projects.
+ * 
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+public class EditProfile extends DefaultLessonAction
+{
+
+	public EditProfile(GoatHillsFinancial lesson, String lessonName, String actionName)
+	{
+		super(lesson, lessonName, actionName);
+	}
+
+	public void handleRequest(WebSession s) throws ParameterNotFoundException, UnauthenticatedException,
+			UnauthorizedException
+	{
+		getLesson().setCurrentAction(s, getActionName());
+
+		if (isAuthenticated(s))
+		{
+			int userId = getUserId(s);
+			int employeeId = s.getParser().getIntParameter(CrossSiteScripting.EMPLOYEE_ID);
+
+			Employee employee = getEmployeeProfile(s, userId, employeeId);
+			setSessionAttribute(s, getLessonName() + "." + CrossSiteScripting.EMPLOYEE_ATTRIBUTE_KEY, employee);
+		}
+		else
+			throw new UnauthenticatedException();
+	}
+
+	public String getNextPage(WebSession s)
+	{
+		return CrossSiteScripting.EDITPROFILE_ACTION;
+	}
+
+	public Employee getEmployeeProfile(WebSession s, int userId, int subjectUserId) throws UnauthorizedException
+	{
+		Employee profile = null;
+
+		// Query the database for the profile data of the given employee
+		try
+		{
+			String query = "SELECT * FROM employee WHERE userid = ?";
+
+			try
+			{
+				PreparedStatement answer_statement = WebSession.getConnection(s)
+						.prepareStatement(query, ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
+				answer_statement.setInt(1, subjectUserId);
+				ResultSet answer_results = answer_statement.executeQuery();
+				if (answer_results.next())
+				{
+					// Note: Do NOT get the password field.
+					profile = new Employee(answer_results.getInt("userid"), answer_results.getString("first_name"),
+							answer_results.getString("last_name"), answer_results.getString("ssn"), answer_results
+									.getString("title"), answer_results.getString("phone"), answer_results
+									.getString("address1"), answer_results.getString("address2"), answer_results
+									.getInt("manager"), answer_results.getString("start_date"), answer_results
+									.getInt("salary"), answer_results.getString("ccn"), answer_results
+									.getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results
+									.getString("disciplined_notes"), answer_results.getString("personal_description"));
+					/*
+					 * System.out.println("Retrieved employee from db: " + profile.getFirstName() +
+					 * " " + profile.getLastName() + " (" + profile.getId() + ")");
+					 */}
+			} catch (SQLException sqle)
+			{
+				s.setMessage("Error getting employee profile");
+				sqle.printStackTrace();
+			}
+		} catch (Exception e)
+		{
+			s.setMessage("Error getting employee profile");
+			e.printStackTrace();
+		}
+
+		return profile;
+	}
+
+	public Employee getEmployeeProfile_BACKUP(WebSession s, int userId, int subjectUserId) throws UnauthorizedException
+	{
+		Employee profile = null;
+
+		// Query the database for the profile data of the given employee
+		try
+		{
+			String query = "SELECT * FROM employee WHERE userid = ?";
+
+			try
+			{
+				PreparedStatement answer_statement = WebSession.getConnection(s)
+						.prepareStatement(query, ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
+				answer_statement.setInt(1, subjectUserId);
+				ResultSet answer_results = answer_statement.executeQuery();
+				if (answer_results.next())
+				{
+					// Note: Do NOT get the password field.
+					profile = new Employee(answer_results.getInt("userid"), answer_results.getString("first_name"),
+							answer_results.getString("last_name"), answer_results.getString("ssn"), answer_results
+									.getString("title"), answer_results.getString("phone"), answer_results
+									.getString("address1"), answer_results.getString("address2"), answer_results
+									.getInt("manager"), answer_results.getString("start_date"), answer_results
+									.getInt("salary"), answer_results.getString("ccn"), answer_results
+									.getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results
+									.getString("disciplined_notes"), answer_results.getString("personal_description"));
+					/*
+					 * System.out.println("Retrieved employee from db: " + profile.getFirstName() +
+					 * " " + profile.getLastName() + " (" + profile.getId() + ")");
+					 */}
+			} catch (SQLException sqle)
+			{
+				s.setMessage("Error getting employee profile");
+				sqle.printStackTrace();
+			}
+		} catch (Exception e)
+		{
+			s.setMessage("Error getting employee profile");
+			e.printStackTrace();
+		}
+
+		return profile;
+	}
+
+}

java/org/owasp/webgoat/lessons/CrossSiteScripting/FindProfile.java

@@ -0,0 +1,220 @@
+
+package org.owasp.webgoat.lessons.CrossSiteScripting;
+
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.DefaultLessonAction;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.GoatHillsFinancial;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.LessonAction;
+import org.owasp.webgoat.session.Employee;
+import org.owasp.webgoat.session.ParameterNotFoundException;
+import org.owasp.webgoat.session.UnauthenticatedException;
+import org.owasp.webgoat.session.UnauthorizedException;
+import org.owasp.webgoat.session.ValidationException;
+import org.owasp.webgoat.session.WebSession;
+
+
+/***************************************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at code.google.com, a repository for free software
+ * projects.
+ * 
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+public class FindProfile extends DefaultLessonAction
+{
+
+	private LessonAction chainedAction;
+
+	public FindProfile(GoatHillsFinancial lesson, String lessonName, String actionName, LessonAction chainedAction)
+	{
+		super(lesson, lessonName, actionName);
+		this.chainedAction = chainedAction;
+	}
+
+	public void handleRequest(WebSession s) throws ParameterNotFoundException, UnauthenticatedException,
+			UnauthorizedException, ValidationException
+	{
+		if (isAuthenticated(s))
+		{
+			int userId = getIntSessionAttribute(s, getLessonName() + "." + CrossSiteScripting.USER_ID);
+
+			String searchName = null;
+			try
+			{
+				searchName = getRequestParameter(s, CrossSiteScripting.SEARCHNAME);
+
+				Employee employee = null;
+
+				employee = findEmployeeProfile(s, userId, searchName);
+				if (employee == null)
+				{
+					setSessionAttribute(s, getLessonName() + "." + CrossSiteScripting.SEARCHRESULT_ATTRIBUTE_KEY,
+										"Employee " + searchName + " not found.");
+				}
+			} catch (ValidationException e)
+			{
+				if (CrossSiteScripting.STAGE6.equals(getStage(s)))
+				{
+					setStageComplete(s, CrossSiteScripting.STAGE6);
+				}
+				throw e;
+			}
+
+			if (CrossSiteScripting.STAGE5.equals(getStage(s)))
+			{
+				if (searchName.indexOf("<script>") > -1 && searchName.indexOf("alert") > -1
+						&& searchName.indexOf("</script>") > -1)
+				{
+					setStageComplete(s, CrossSiteScripting.STAGE5);
+				}
+			}
+
+			// Execute the chained Action if the employee was found.
+			if (foundEmployee(s))
+			{
+				try
+				{
+					chainedAction.handleRequest(s);
+				} catch (UnauthenticatedException ue1)
+				{
+					// System.out.println("Internal server error");
+					ue1.printStackTrace();
+				} catch (UnauthorizedException ue2)
+				{
+					// System.out.println("Internal server error");
+					ue2.printStackTrace();
+				}
+			}
+		}
+		else
+			throw new UnauthenticatedException();
+	}
+
+	public String getNextPage(WebSession s)
+	{
+		String page = CrossSiteScripting.SEARCHSTAFF_ACTION;
+
+		if (foundEmployee(s)) page = CrossSiteScripting.VIEWPROFILE_ACTION;
+
+		return page;
+	}
+
+	protected String getRequestParameter(WebSession s, String name) throws ParameterNotFoundException,
+			ValidationException
+	{
+
+		return s.getParser().getRawParameter(name);
+	}
+
+	protected String getRequestParameter_BACKUP(WebSession s, String name) throws ParameterNotFoundException,
+			ValidationException
+	{
+		return s.getParser().getRawParameter(name);
+	}
+
+	public Employee findEmployeeProfile(WebSession s, int userId, String pattern) throws UnauthorizedException
+	{
+		Employee profile = null;
+
+		// Query the database for the profile data of the given employee
+		try
+		{
+			String query = "SELECT * FROM employee WHERE first_name like ? OR last_name like ?";
+
+			try
+			{
+				PreparedStatement answer_statement = WebSession.getConnection(s)
+						.prepareStatement(query, ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
+				answer_statement.setString(1, "%" + pattern + "%");
+				answer_statement.setString(2, "%" + pattern + "%");
+				ResultSet answer_results = answer_statement.executeQuery();
+
+				// Just use the first hit.
+				if (answer_results.next())
+				{
+					int id = answer_results.getInt("userid");
+					// Note: Do NOT get the password field.
+					profile = new Employee(id, answer_results.getString("first_name"), answer_results
+							.getString("last_name"), answer_results.getString("ssn"),
+							answer_results.getString("title"), answer_results.getString("phone"), answer_results
+									.getString("address1"), answer_results.getString("address2"), answer_results
+									.getInt("manager"), answer_results.getString("start_date"), answer_results
+									.getInt("salary"), answer_results.getString("ccn"), answer_results
+									.getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results
+									.getString("disciplined_notes"), answer_results.getString("personal_description"));
+
+					/*
+					 * System.out.println("Retrieved employee from db: " + profile.getFirstName() +
+					 * " " + profile.getLastName() + " (" + profile.getId() + ")");
+					 */
+					setRequestAttribute(s, getLessonName() + "." + CrossSiteScripting.EMPLOYEE_ID, Integer.toString(id));
+				}
+			} catch (SQLException sqle)
+			{
+				s.setMessage("Error finding employee profile");
+				sqle.printStackTrace();
+			}
+		} catch (Exception e)
+		{
+			s.setMessage("Error finding employee profile");
+			e.printStackTrace();
+		}
+
+		return profile;
+	}
+
+	private boolean foundEmployee(WebSession s)
+	{
+		boolean found = false;
+		try
+		{
+			getIntRequestAttribute(s, getLessonName() + "." + CrossSiteScripting.EMPLOYEE_ID);
+			found = true;
+		} catch (ParameterNotFoundException e)
+		{
+		}
+
+		return found;
+	}
+
+	protected String validate(final String parameter, final Pattern pattern) throws ValidationException
+	{
+		Matcher matcher = pattern.matcher(parameter);
+		if (!matcher.matches()) throw new ValidationException();
+
+		return parameter;
+	}
+
+	protected static Map<String, Pattern> patterns = new HashMap<String, Pattern>();
+	static
+	{
+		patterns.put(CrossSiteScripting.SEARCHNAME, Pattern.compile("[a-zA-Z ]{0,20}"));
+	}
+
+}

java/org/owasp/webgoat/lessons/CrossSiteScripting/UpdateProfile.java

@@ -0,0 +1,384 @@
+
+package org.owasp.webgoat.lessons.CrossSiteScripting;
+
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.PreparedStatement;
+import java.sql.Statement;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import javax.servlet.http.HttpServletRequest;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.DefaultLessonAction;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.GoatHillsFinancial;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.LessonAction;
+import org.owasp.webgoat.session.Employee;
+import org.owasp.webgoat.session.ParameterNotFoundException;
+import org.owasp.webgoat.session.ParameterParser;
+import org.owasp.webgoat.session.UnauthenticatedException;
+import org.owasp.webgoat.session.UnauthorizedException;
+import org.owasp.webgoat.session.ValidationException;
+import org.owasp.webgoat.session.WebSession;
+
+
+/***************************************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at code.google.com, a repository for free software
+ * projects.
+ * 
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+public class UpdateProfile extends DefaultLessonAction
+{
+
+	private LessonAction chainedAction;
+
+	public UpdateProfile(GoatHillsFinancial lesson, String lessonName, String actionName, LessonAction chainedAction)
+	{
+		super(lesson, lessonName, actionName);
+		this.chainedAction = chainedAction;
+	}
+
+	public void handleRequest(WebSession s) throws ParameterNotFoundException, UnauthenticatedException,
+			UnauthorizedException, ValidationException
+	{
+		if (isAuthenticated(s))
+		{
+			int userId = getIntSessionAttribute(s, getLessonName() + "." + CrossSiteScripting.USER_ID);
+
+			int subjectId = s.getParser().getIntParameter(CrossSiteScripting.EMPLOYEE_ID, 0);
+
+			Employee employee = null;
+			try
+			{
+				employee = parseEmployeeProfile(subjectId, s);
+			} catch (ValidationException e)
+			{
+				if (CrossSiteScripting.STAGE2.equals(getStage(s)))
+				{
+					setStageComplete(s, CrossSiteScripting.STAGE2);
+				}
+				throw e;
+			}
+
+			if (subjectId > 0)
+			{
+				this.changeEmployeeProfile(s, userId, subjectId, employee);
+				setRequestAttribute(s, getLessonName() + "." + CrossSiteScripting.EMPLOYEE_ID, Integer
+						.toString(subjectId));
+			}
+			else
+				this.createEmployeeProfile(s, userId, employee);
+
+			try
+			{
+				chainedAction.handleRequest(s);
+			} catch (UnauthenticatedException ue1)
+			{
+				// System.out.println("Internal server error");
+				ue1.printStackTrace();
+			} catch (UnauthorizedException ue2)
+			{
+				// System.out.println("Internal server error");
+				ue2.printStackTrace();
+			}
+		}
+		else
+			throw new UnauthenticatedException();
+	}
+
+	protected Employee parseEmployeeProfile(int subjectId, WebSession s) throws ParameterNotFoundException,
+			ValidationException
+	{
+		// The input validation can be added using a parsing component
+		// or by using an inline regular expression. The parsing component
+		// is the better solution.
+
+		HttpServletRequest request = s.getRequest();
+		String firstName = request.getParameter(CrossSiteScripting.FIRST_NAME);
+		String lastName = request.getParameter(CrossSiteScripting.LAST_NAME);
+		String ssn = request.getParameter(CrossSiteScripting.SSN);
+		String title = request.getParameter(CrossSiteScripting.TITLE);
+		String phone = request.getParameter(CrossSiteScripting.PHONE_NUMBER);
+		String address1 = request.getParameter(CrossSiteScripting.ADDRESS1);
+		String address2 = request.getParameter(CrossSiteScripting.ADDRESS2);
+		int manager = Integer.parseInt(request.getParameter(CrossSiteScripting.MANAGER));
+		String startDate = request.getParameter(CrossSiteScripting.START_DATE);
+		int salary = Integer.parseInt(request.getParameter(CrossSiteScripting.SALARY));
+		String ccn = request.getParameter(CrossSiteScripting.CCN);
+		int ccnLimit = Integer.parseInt(request.getParameter(CrossSiteScripting.CCN_LIMIT));
+		String disciplinaryActionDate = request.getParameter(CrossSiteScripting.DISCIPLINARY_DATE);
+		String disciplinaryActionNotes = request.getParameter(CrossSiteScripting.DISCIPLINARY_NOTES);
+		String personalDescription = request.getParameter(CrossSiteScripting.DESCRIPTION);
+
+		Employee employee = new Employee(subjectId, firstName, lastName, ssn, title, phone, address1, address2,
+				manager, startDate, salary, ccn, ccnLimit, disciplinaryActionDate, disciplinaryActionNotes,
+				personalDescription);
+
+		return employee;
+	}
+
+	protected Employee parseEmployeeProfile_BACKUP(int subjectId, WebSession s) throws ParameterNotFoundException,
+			ValidationException
+	{
+		// The input validation can be added using a parsing component
+		// or by using an inline regular expression. The parsing component
+		// is the better solution.
+
+		HttpServletRequest request = s.getRequest();
+		String firstName = request.getParameter(CrossSiteScripting.FIRST_NAME);
+		String lastName = request.getParameter(CrossSiteScripting.LAST_NAME);
+		String ssn = request.getParameter(CrossSiteScripting.SSN);
+		String title = request.getParameter(CrossSiteScripting.TITLE);
+		String phone = request.getParameter(CrossSiteScripting.PHONE_NUMBER);
+		String address1 = request.getParameter(CrossSiteScripting.ADDRESS1);
+		String address2 = request.getParameter(CrossSiteScripting.ADDRESS2);
+		int manager = Integer.parseInt(request.getParameter(CrossSiteScripting.MANAGER));
+		String startDate = request.getParameter(CrossSiteScripting.START_DATE);
+		int salary = Integer.parseInt(request.getParameter(CrossSiteScripting.SALARY));
+		String ccn = request.getParameter(CrossSiteScripting.CCN);
+		int ccnLimit = Integer.parseInt(request.getParameter(CrossSiteScripting.CCN_LIMIT));
+		String disciplinaryActionDate = request.getParameter(CrossSiteScripting.DISCIPLINARY_DATE);
+		String disciplinaryActionNotes = request.getParameter(CrossSiteScripting.DISCIPLINARY_NOTES);
+		String personalDescription = request.getParameter(CrossSiteScripting.DESCRIPTION);
+
+		Employee employee = new Employee(subjectId, firstName, lastName, ssn, title, phone, address1, address2,
+				manager, startDate, salary, ccn, ccnLimit, disciplinaryActionDate, disciplinaryActionNotes,
+				personalDescription);
+
+		return employee;
+	}
+
+	protected Employee doParseEmployeeProfile(int subjectId, ParameterParser parser) throws ParameterNotFoundException,
+			ValidationException
+	{
+		// Fix this method using the org.owasp.webgoat.session.ParameterParser class
+		return null;
+	}
+
+	public String getNextPage(WebSession s)
+	{
+		return CrossSiteScripting.VIEWPROFILE_ACTION;
+	}
+
+	public void changeEmployeeProfile(WebSession s, int userId, int subjectId, Employee employee)
+			throws UnauthorizedException
+	{
+		try
+		{
+			// Note: The password field is ONLY set by ChangePassword
+			String query = "UPDATE employee SET first_name = ?, last_name = ?, ssn = ?, title = ?, phone = ?, address1 = ?, address2 = ?,"
+					+ " manager = ?, start_date = ?, ccn = ?, ccn_limit = ?,"
+					+ " personal_description = ? WHERE userid = ?;";
+			try
+			{
+				PreparedStatement ps = WebSession.getConnection(s).prepareStatement(query,
+																					ResultSet.TYPE_SCROLL_INSENSITIVE,
+																					ResultSet.CONCUR_READ_ONLY);
+
+				ps.setString(1, employee.getFirstName());
+				ps.setString(2, employee.getLastName());
+				ps.setString(3, employee.getSsn());
+				ps.setString(4, employee.getTitle());
+				ps.setString(5, employee.getPhoneNumber());
+				ps.setString(6, employee.getAddress1());
+				ps.setString(7, employee.getAddress2());
+				ps.setInt(8, employee.getManager());
+				ps.setString(9, employee.getStartDate());
+				ps.setString(10, employee.getCcn());
+				ps.setInt(11, employee.getCcnLimit());
+				ps.setString(12, employee.getPersonalDescription());
+				ps.setInt(13, subjectId);
+				ps.execute();
+			} catch (SQLException sqle)
+			{
+				s.setMessage("Error updating employee profile");
+				sqle.printStackTrace();
+			}
+
+		} catch (Exception e)
+		{
+			s.setMessage("Error updating employee profile");
+			e.printStackTrace();
+		}
+	}
+
+	public void doChangeEmployeeProfile_BACKUP(WebSession s, int userId, int subjectId, Employee employee)
+			throws UnauthorizedException
+	{
+		try
+		{
+			// Note: The password field is ONLY set by ChangePassword
+			String query = "UPDATE employee SET first_name = ?, last_name = ?, ssn = ?, title = ?, phone = ?, address1 = ?, address2 = ?,"
+					+ " manager = ?, start_date = ?, ccn = ?, ccn_limit = ?,"
+					+ " personal_description = ? WHERE userid = ?;";
+			try
+			{
+				PreparedStatement ps = WebSession.getConnection(s).prepareStatement(query,
+																					ResultSet.TYPE_SCROLL_INSENSITIVE,
+																					ResultSet.CONCUR_READ_ONLY);
+
+				ps.setString(1, employee.getFirstName());
+				ps.setString(2, employee.getLastName());
+				ps.setString(3, employee.getSsn());
+				ps.setString(4, employee.getTitle());
+				ps.setString(5, employee.getPhoneNumber());
+				ps.setString(6, employee.getAddress1());
+				ps.setString(7, employee.getAddress2());
+				ps.setInt(8, employee.getManager());
+				ps.setString(9, employee.getStartDate());
+				ps.setString(10, employee.getCcn());
+				ps.setInt(11, employee.getCcnLimit());
+				ps.setString(12, employee.getPersonalDescription());
+				ps.setInt(13, subjectId);
+				ps.executeUpdate(query);
+			} catch (SQLException sqle)
+			{
+				s.setMessage("Error updating employee profile");
+				sqle.printStackTrace();
+			}
+
+		} catch (Exception e)
+		{
+			s.setMessage("Error updating employee profile");
+			e.printStackTrace();
+		}
+	}
+
+	public void createEmployeeProfile(WebSession s, int userId, Employee employee) throws UnauthorizedException
+	{
+		try
+		{
+			// FIXME: Cannot choose the id because we cannot guarantee uniqueness
+			int nextId = getNextUID(s);
+			String query = "INSERT INTO employee VALUES ( " + nextId + ", ?,?,?,?,?,?,?,?,?,?,?,?,?,?)";
+
+			// System.out.println("Query: " + query);
+
+			try
+			{
+				PreparedStatement ps = WebSession.getConnection(s).prepareStatement(query);
+
+				ps.setString(1, employee.getFirstName().toLowerCase());
+				ps.setString(2, employee.getLastName());
+				ps.setString(3, employee.getSsn());
+				ps.setString(4, employee.getTitle());
+				ps.setString(5, employee.getPhoneNumber());
+				ps.setString(6, employee.getAddress1());
+				ps.setString(7, employee.getAddress2());
+				ps.setInt(8, employee.getManager());
+				ps.setString(9, employee.getStartDate());
+				ps.setString(10, employee.getCcn());
+				ps.setInt(11, employee.getCcnLimit());
+				ps.setString(12, employee.getDisciplinaryActionDate());
+				ps.setString(13, employee.getDisciplinaryActionNotes());
+				ps.setString(14, employee.getPersonalDescription());
+
+				ps.execute();
+			} catch (SQLException sqle)
+			{
+				s.setMessage("Error updating employee profile");
+				sqle.printStackTrace();
+			}
+		} catch (Exception e)
+		{
+			s.setMessage("Error updating employee profile");
+			e.printStackTrace();
+		}
+	}
+
+	public void createEmployeeProfile_BACKUP(WebSession s, int userId, Employee employee) throws UnauthorizedException
+	{
+		try
+		{
+			// FIXME: Cannot choose the id because we cannot guarantee uniqueness
+			int nextId = getNextUID(s);
+			String query = "INSERT INTO employee VALUES ( " + nextId + ", ?,?,?,?,?,?,?,?,?,?,?,?,?,?)";
+
+			// System.out.println("Query: " + query);
+
+			try
+			{
+				PreparedStatement ps = WebSession.getConnection(s).prepareStatement(query);
+
+				ps.setString(1, employee.getFirstName().toLowerCase());
+				ps.setString(2, employee.getLastName());
+				ps.setString(3, employee.getSsn());
+				ps.setString(4, employee.getTitle());
+				ps.setString(5, employee.getPhoneNumber());
+				ps.setString(6, employee.getAddress1());
+				ps.setString(7, employee.getAddress2());
+				ps.setInt(8, employee.getManager());
+				ps.setString(9, employee.getStartDate());
+				ps.setString(10, employee.getCcn());
+				ps.setInt(11, employee.getCcnLimit());
+				ps.setString(12, employee.getDisciplinaryActionDate());
+				ps.setString(13, employee.getDisciplinaryActionNotes());
+				ps.setString(14, employee.getPersonalDescription());
+
+				ps.execute();
+			} catch (SQLException sqle)
+			{
+				s.setMessage("Error updating employee profile");
+				sqle.printStackTrace();
+			}
+		} catch (Exception e)
+		{
+			s.setMessage("Error updating employee profile");
+			e.printStackTrace();
+		}
+	}
+
+	/**
+	 * Validates that the given parameter value matches the given regular expression pattern.
+	 * 
+	 * @param parameter
+	 * @param pattern
+	 * @return
+	 * @throws ValidationException
+	 */
+	protected String validate(final String parameter, final Pattern pattern) throws ValidationException
+	{
+		Matcher matcher = pattern.matcher(parameter);
+		if (!matcher.matches()) throw new ValidationException();
+
+		return parameter;
+	}
+
+	private int getNextUID(WebSession s)
+	{
+		int uid = -1;
+		try
+		{
+			Statement statement = WebSession.getConnection(s).createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
+																				ResultSet.CONCUR_READ_ONLY);
+			ResultSet results = statement.executeQuery("select max(userid) as uid from employee");
+			results.first();
+			uid = results.getInt("uid");
+		} catch (SQLException sqle)
+		{
+			sqle.printStackTrace();
+			s.setMessage("Error updating employee profile");
+		}
+		return uid + 1;
+	}
+}

java/org/owasp/webgoat/lessons/CrossSiteScripting/ViewProfile.java

@@ -0,0 +1,213 @@
+
+package org.owasp.webgoat.lessons.CrossSiteScripting;
+
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.DefaultLessonAction;
+import org.owasp.webgoat.lessons.GoatHillsFinancial.GoatHillsFinancial;
+import org.owasp.webgoat.session.Employee;
+import org.owasp.webgoat.session.ParameterNotFoundException;
+import org.owasp.webgoat.session.UnauthenticatedException;
+import org.owasp.webgoat.session.UnauthorizedException;
+import org.owasp.webgoat.session.ValidationException;
+import org.owasp.webgoat.session.WebSession;
+
+
+/***************************************************************************************************
+ * 
+ * 
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ * 
+ * Copyright (c) 2002 - 2007 Bruce Mayhew
+ * 
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ * 
+ * Getting Source ==============
+ * 
+ * Source for this application is maintained at code.google.com, a repository for free software
+ * projects.
+ * 
+ * For details, please see http://code.google.com/p/webgoat/
+ */
+public class ViewProfile extends DefaultLessonAction
+{
+
+	public ViewProfile(GoatHillsFinancial lesson, String lessonName, String actionName)
+	{
+		super(lesson, lessonName, actionName);
+	}
+
+	public void handleRequest(WebSession s) throws ParameterNotFoundException, UnauthenticatedException,
+			UnauthorizedException, ValidationException
+	{
+		getLesson().setCurrentAction(s, getActionName());
+
+		if (isAuthenticated(s))
+		{
+			int userId = getIntSessionAttribute(s, getLessonName() + "." + CrossSiteScripting.USER_ID);
+			int employeeId = -1;
+			try
+			{
+				// User selected employee
+				employeeId = s.getParser().getIntParameter(CrossSiteScripting.EMPLOYEE_ID);
+			} catch (ParameterNotFoundException e)
+			{
+				// May be an internally selected employee
+				employeeId = getIntRequestAttribute(s, getLessonName() + "." + CrossSiteScripting.EMPLOYEE_ID);
+			}
+
+			Employee employee = getEmployeeProfile(s, userId, employeeId);
+			setSessionAttribute(s, getLessonName() + "." + CrossSiteScripting.EMPLOYEE_ATTRIBUTE_KEY, employee);
+
+			updateLessonStatus(s, employee);
+		}
+		else
+			throw new UnauthenticatedException();
+	}
+
+	public String getNextPage(WebSession s)
+	{
+		return CrossSiteScripting.VIEWPROFILE_ACTION;
+	}
+
+	public Employee getEmployeeProfile(WebSession s, int userId, int subjectUserId) throws UnauthorizedException
+	{
+		Employee profile = null;
+
+		// Query the database for the profile data of the given employee
+		try
+		{
+			String query = "SELECT * FROM employee WHERE userid = " + subjectUserId;
+			try
+			{
+				Statement answer_statement = WebSession.getConnection(s)
+						.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
+				ResultSet answer_results = answer_statement.executeQuery(query);
+				if (answer_results.next())
+				{
+
+					// Note: Do NOT get the password field.
+					profile = new Employee(answer_results.getInt("userid"), answer_results.getString("first_name"),
+							answer_results.getString("last_name"), answer_results.getString("ssn"), answer_results
+									.getString("title"), answer_results.getString("phone"), answer_results
+									.getString("address1"), answer_results.getString("address2"), answer_results
+									.getInt("manager"), answer_results.getString("start_date"), answer_results
+									.getInt("salary"), answer_results.getString("ccn"), answer_results
+									.getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results
+									.getString("disciplined_notes"), answer_results.getString("personal_description"));
+					/*
+					 * System.out.println("Retrieved employee from db: " + profile.getFirstName() +
+					 * " " + profile.getLastName() + " (" + profile.getId() + ")");
+					 */}
+			} catch (SQLException sqle)
+			{
+				s.setMessage("Error getting employee profile");
+				sqle.printStackTrace();
+			}
+		} catch (Exception e)
+		{
+			s.setMessage("Error getting employee profile");
+			e.printStackTrace();
+		}
+
+		return profile;
+	}
+
+	public Employee getEmployeeProfile_BACKUP(WebSession s, int userId, int subjectUserId) throws UnauthorizedException
+	{
+		// Query the database to determine if this employee has access to this function
+		// Query the database for the profile data of the given employee if "owned" by the given
+		// user
+
+		Employee profile = null;
+
+		// Query the database for the profile data of the given employee
+		try
+		{
+			String query = "SELECT * FROM employee WHERE userid = " + subjectUserId;
+
+			try
+			{
+				Statement answer_statement = WebSession.getConnection(s)
+						.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
+				ResultSet answer_results = answer_statement.executeQuery(query);
+				if (answer_results.next())
+				{
+					// Note: Do NOT get the password field.
+					profile = new Employee(answer_results.getInt("userid"), answer_results.getString("first_name"),
+							answer_results.getString("last_name"), answer_results.getString("ssn"), answer_results
+									.getString("title"), answer_results.getString("phone"), answer_results
+									.getString("address1"), answer_results.getString("address2"), answer_results
+									.getInt("manager"), answer_results.getString("start_date"), answer_results
+									.getInt("salary"), answer_results.getString("ccn"), answer_results
+									.getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results
+									.getString("disciplined_notes"), answer_results.getString("personal_description"));
+
+					/*
+					 * System.out.println("Retrieved employee from db: " + profile.getFirstName() +
+					 * " " + profile.getLastName() + " (" + profile.getId() + ")");
+					 */}
+			} catch (SQLException sqle)
+			{
+				s.setMessage("Error getting employee profile");
+				sqle.printStackTrace();
+			}
+		} catch (Exception e)
+		{
+			s.setMessage("Error getting employee profile");
+			e.printStackTrace();
+		}
+
+		return profile;
+	}
+
+	private void updateLessonStatus(WebSession s, Employee employee)
+	{
+		String stage = getStage(s);
+		int userId = -1;
+		try
+		{
+			userId = getIntSessionAttribute(s, getLessonName() + "." + CrossSiteScripting.USER_ID);
+		} catch (ParameterNotFoundException pnfe)
+		{
+		}
+		if (CrossSiteScripting.STAGE1.equals(stage))
+		{
+			String address1 = employee.getAddress1().toLowerCase();
+			if (userId != employee.getId() && address1.indexOf("<script>") > -1 && address1.indexOf("alert") > -1
+					&& address1.indexOf("</script>") > -1)
+			{
+				setStageComplete(s, CrossSiteScripting.STAGE1);
+			}
+		}
+		else if (CrossSiteScripting.STAGE3.equals(stage))
+		{
+			String address2 = employee.getAddress1().toLowerCase();
+			if (address2.indexOf("<script>") > -1 && address2.indexOf("alert") > -1
+					&& address2.indexOf("</script>") > -1)
+			{
+				setStageComplete(s, CrossSiteScripting.STAGE3);
+			}
+		}
+		else if (CrossSiteScripting.STAGE4.equals(stage))
+		{
+			if (employee.getAddress1().toLowerCase().indexOf("&lt;") > -1)
+			{
+				setStageComplete(s, CrossSiteScripting.STAGE4);
+			}
+		}
+	}
+
+}