Inurl Indexphpid Upd __link__ Info

Jay didn't have malicious intent — he was ethical. He manually changed the id=245 to id=245 OR 1=1 . The page loaded all products. Then he tried id=245 UNION SELECT username, password FROM users . The database helpfully returned admin credentials in plaintext.