#StringSqlInjection.java
StringSqlInjectionSecondStage=Now that you have successfully performed an SQL injection, try the same type of attack on a parameterized query.  Restart the lesson if you wish to return to the injectable query.
EnterLastName=Enter your last name:

sql.injection.title=SQL Injection (introduction)
sql.mitigation.title=SQL Injection (mitigation)
sql.advanced.title=SQL Injection (advanced)

SqlInjectionChallenge1=Look at the different response you receive from the server
SqlInjectionChallenge2=The vulnerability is on the register form
SqlInjectionChallenge3=Use tooling to automate this attack

NoResultsMatched=No results matched. Try Again.
SqlStringInjectionHint6=Try Appending a new SQL Statement to the Query.
SqlStringInjectionHint7=The new SQL Statement can be really simple like: SELECT ... FROM ...
SqlStringInjectionHint8=Your new SQL Query should start, with a " ; " and end with " -- "
SqlStringInjectionHint9=Try sorting and look at the request
SqlStringInjectionHint10=Intercept the request and try to specify a different order by
SqlStringInjectionHint10a1=First establish a connection, after that you can create a statement.
SqlStringInjectionHint10a2=For every datatype there is a method to insert values into a wildcard symbol in a statement.
SqlStringInjectionHint10b1=A database connection has to be surrounded by a try-catch block to handle the very common case of an error while establishing the connection!
SqlStringInjectionHint10b2=Remember to use the right kind of statement, so your code is no longer vulnerable for SQL-Injections!
SqlStringInjectionHint10b3=The wildcard-symbol '?' in a prepared statement can be filled with the right kind of method. There exists one for every datatype!
SqlStringInjectionHint11=Use for example "(case when (true) then hostname else id end)" in the order by and see what happens
SqlStringInjectionHint12=Use for example "(case when (true) then hostname else id end)" in the order by and see what happens

sql-injection.5a.success=You have succeeded: {0}
sql-injection.5a.no.results=No results matched. Try Again.

sql-injection.5b.success=You have succeeded: {0}
sql-injection.5b.no.results=No results matched. Try Again.

sql-injection.6a.success=You have succeeded: {0}
sql-injection.6a.no.results=No results matched. Try Again.

sql-injection.6b.success=You have succeeded: {0}
sql-injection.6b.no.results=No results matched. Try Again.

sql-injection.8.success=You have succeeded! You successfully compromised the confidentiality of data by viewing internal information that you should not have access to. Well done! {0}
sql-injection.8.no.results=No employee found with matching lastname. Or maybe your authentication TAN is incorrect?

SqlStringInjectionHint8-1=The application is taking your input and inserting the values into the variables 'name' and 'auth_tan' of the pre-formed SQL command.
SqlStringInjectionHint8-2=Compound SQL statements can be made by expanding the WHERE clause of the statement with keywords like AND and OR.
SqlStringInjectionHint8-3=Try appending a SQL statement that always resolves to true.
SqlStringInjectionHint8-4=Make sure all quotes (" ' ") are opened and closed properly so the resulting SQL query is syntactically correct.
SqlStringInjectionHint8-5=Try extending the WHERE clause of the statement by adding something like: ' OR '1' = '1.

sql-injection.9.success=Well done! Now you're earning the most money. And at the same time you successfully compromised the integrity of data by changing the salary. {0}

SqlStringInjectionHint9-1=Try to find a way, to chain another query to the end of the existing one.
SqlStringInjectionHint9-2=Use the ; metacharacter to do so.
SqlStringInjectionHint9-3=Make use of DML to change your salary.
SqlStringInjectionHint9-4=Make sure that the resulting query is syntactically correct.
SqlStringInjectionHint9-5=How about something like '; UPDATE employees....

sql-injection.10.success=Success! You successfully deleted the access_log table and that way compromised the availability of the data.