Hello and welcome to this video and this video we are going to discuss about how an application fetches
the user's data from the database with the help of a school.
Let's imagine this is an application made by to for all its students.
So every user and does the user name and.
And does the correct password, he or she is allowed to enter into the application and maybe he or she
can see their profile, their progress, maybe their attendance and a lot of things.
So this is how generally an application looks like and it works.
So how the application takes help from the database to fetch the users.
Correct details such as the correct username and password.
So we will see the general security water has been used in most of the applications.
So here is the General Escuela query your I am taking username as admin and password as admin.
Let's imagine that this user does exist into the database.
So the query should look something like select star from student where user name equals admin and password
equals admin.
So if both the details match and do the database as we have used and logic operator over a year, which
means if both the conditions are true, only if both the conditions are true, then only and operator
will allow to access the application or else it will not allow the user to go into the application.
But as I said there.
Both the details does exist into the database, let's imagine this or both username and password is
correct so that men will be able to see the profile page which says hello Erdmann, which belongs to
a particular user.
So this is our application generally works.
When you enter in your credentials, your username and your password, it forms up equerry.
It fits into the query and then it goes through the database.
It checks whether the user exists or not.
If the user exist, if the credentials are correct, the particular user is allowed in to the application.
Otherwise, he or she might get an error.
Seeing the credentials are not good.
So in the next video, we are going to move towards a scale injection and how do we spoof Aguirre,
how do we spoof a database to get the details without knowing correct passwords and user names?
Thank you so much.