WebGoat/webgoat/main/project/WebContent/lessons/RoleBasedAccessControl/SearchStaff.jsp

<%@ page contentType="text/html; charset=ISO-8859-1" language="java" 
	import="org.owasp.webgoat.session.*, org.owasp.webgoat.lessons.RoleBasedAccessControl.RoleBasedAccessControl" 
	errorPage="" %>
	<div id="lesson_search">
			<% 
			WebSession webSession = ((WebSession)session.getAttribute("websession"));
			String searchedName = request.getParameter(RoleBasedAccessControl.SEARCHNAME);
			if (searchedName != null)
			{
			%>
				Employee <%=searchedName%> not found.
			<%
			}
			%>
				<form id="form1" name="form1" method="post" action="attack?menu=<%=webSession.getCurrentMenu()%>">
			    	<label>Name
					<input class="lesson_text_db" type="text" name="<%=RoleBasedAccessControl.SEARCHNAME%>"/>
		        </label>
				<br>
				<input type="submit" name="action" value="<%=RoleBasedAccessControl.FINDPROFILE_ACTION%>"/>
			</form>
	</div>