The Newbie hacker guide from a noob himself

Why most reviews online are biased and curved (and therefore a SCAM)

2009-07-13T20:50:00.003-04:00

Did you ever notice that most online reviews are curved to the positive? Here's why.

Most reviews let you rate a product , service, or company with a rating from 1 to 5. Sounds fair. right? Wrong!!!!

Take this example:

We'll talk about reviews for this widget.

Mister Aye thinks is the best thing to come out since toilet paper. He quickly gives it a rating of 5.
Miss Bee also bought this product and it broke before she got home. She thinks it's useless and a total waste of money. She gives it a rating of 1.
Mrs. Sea also buys the product and it simply won't do what widgets are supposed to do. What a piece of crap. She gives it a rating of 1.

The average rating is 5+1+1=7 / 3 = 2.33. The site so nicely shows a rating of 2.5 stars (rounded to the nearest half).

When Mr. Dee comes to the site and checks out the rating, it's 2.5 stars out of 5 stars. Okay, he says, half the people like it half don't, an average product. He then decides to buy it, or not.

Mr. Dee was SCAMMMED by the site. For every one person that likes it, there are two people that think it's junk. The true rating should be 1.66 (5+0+0=5/3=1.66). I think Mr. Dee may have decided against the purchase had he seen 1.5 stars instead of the 2.5 shown.
In other words, stars are partly a SCAM!!!!!!!!!

Earn 4 year Bachelor Degree quickly, easily, and for CHEAP - about $5000 or even as low as $3615 (for NJians)

2009-07-12T02:21:00.009-04:00

Oh, and did I mention without sitting through a single class.

Yeah, you're figuring it's another one of those hoaxes. Well, it's not. I am not selling anything here or offering anything here. All I'm doing is giving you the information that you need to get that degree you need/want. And, believe it or not, I have no gain in this. I just want to help out. I know it's a rarity these days, but here I am.

Here goes:

Many people are having a hard time getting a job because they have no Bachelor's degree. Some people are getting passed over for promotions because there's a degree requirement. What are you to do? You don't want to spend $15,000 getting your degree. Also, you don't have time to sit in class or the patience to do the same. Hmm..... is there another alternative? Yes there is and I'll show you how to do it.

First of all, the breakdown that will follow below is for someone that has no previous college credits. Zero. If you have some, you will have an easier , shorter and cheaper time getting your degree.

To get this degree, you have to be ready to learn enough on many topics to get a passing mark on an exam on that topic. We're talking CLEP exams. You may have heard of it before. All it is is a multiple choice exam (usually 100 questions) that covers one topic. The cost is $72 per exam plus you'll pay a proctor fee, which ranges from $20 to $35 depending where you take it. There's a bunch of info available online, if you just use the good old google.

Here's a tip. There's a site called InstantCert.com. For a minimal price you become a member. This gives you access to practice multiple choice questions on a huge variety of CLEP/Dantes exams. From past experience, I have found that using InstantCert will sufficiently prepare you to pass the CLEP exams. I would strongly advise checking it out if you're gonna this route.

Another part of the trick here is to get 25 free electives through FEMA.gov. They offer small courses online for free. Each short course has an open-book final made up of 25-50 multiple choice questions. For each course you pass, subject to limitations, you'll get one college credit. These courses take very little time and will give you 24 of the 120 credits you'll need for the degree.

Here's the whole story. Thomas Edison State College, which is a fully accredited college in New Jersey, will let you earn a degree even if you don't take a single course with them. If you fulfill all the requirements for a degree wherever however, they'll let you transfer in the credits and earn the degree. You must, however, enroll in the college, which is half the cost of this degree.

The breakdown of the costs are as follows:

Application fee $75 - this pays for your evaluation which evaluated your previous studies/transcripts

Annual enrollment fee (which your only gonna do for one year obviously) - $2520

Annual Technology fee - $103

Graduation fee (which is gonna be pretty much right away) - $247

So far that's a total of $2945

Now comes the fun. You are going to take 21 exams, each giving you 3 or 6 credits. for a total of 96 credits. The other 24 credits will be through FEMA. If you estimate the cost of each exam at $100 (it may be a bit less for you), that's another $2100

That brings you to a total of $5045 (See the end of the article to see how it may be way cheaper for you.)

PLEASE NOTE: DISCLAIMER: I have not verified all this information with Thomas Edison State College. If you go this route, you may want to apply, get an evaluation, and make sure this is going to work. I just know that I tested out of 15 courses for my degree, and don't see why this shouldn't work for you.

Below, I have broken down the requirements for the Bachelor's Degree in Liberal Studies at Thomas Edison State College, and how you'll fulfill those requirements by exam.

A. English Composition (6 credits)

CLEP English Composition with Essay (6 credits)

B. Humanities (12 credits)

CLEP American Literature (6 credits)
CLEP Humanities - General (6 credits)

C. Social Sciences (12 credits)

CLEP Social Sciences and History General (6 credits)
CLEP American Government (3 credits)
CLEP Human Growth and Development (3 credits)

D. Natural Sciences and Mathematics (12 credits)

CLEP College Mathematics General (6 credits)
CLEP Natural Sciences - General (6 credits)

E. General Education Electives (18 credits)

CLEP Chemistry (6 credits)
CLEP Biology (6 credits)
CLEP English Literature (6 credits)

F. Liberal Studies (33 credits)
(Only 2 courses can be at the 100 level)
(Must be at least two areas)

CLEP Analyzing and Interpreting Literature (6 credits)
CLEP Introduction to Educational Psychology (3 credits)
Dantes Introduction to Computing (3 credits)
Dantes Ethics in America (3 credits)
Dantes Environment and Humanity: The Race to Save the Plant (3 credits)
Dantes Lifespan Developmental Psychology (3 credits)
Dantes Organizational Behavior (3 credits)
Dantes Drug and Alcohol Abuse
Dantes Technical Writing Dantes Human/Cultural Geography

G. Free Electives (27 credits)

Dantes Foundations of Education (3 credits)
Free FEMA online courses - 24 courses - 1 credit each course (24 credits)

Total credits: 120 credits

Total number of CLEP/Dantes exams: 21 exams

Please note: There are many more CLEP and Dantes exams available that will do the job as well. You should check out all the exams, see which would be easier for you etc. I have, however, used all the 6 credit exams in the calculations (see below for an exception).

---------------------------------------------

Now in the title I wrote "or for as low as $3615". How do I explain that.It's actually quite simple. If you live in New Jersey, as I do, then instead of paying $2520 for enrollment, you pay only $1390. That takes $1130 off the costs, bring it down to $3915.

Now if you know Spanish well, or French or German, there is a CLEP exam worth 12 credits that will replace one of the 3 credit exams I counted. This will take $300 off the costs (3 exams less), bringing the cost down to $3615

Please leave comments and suggestions if you have any.

Experiment

2009-07-08T14:51:00.003-04:00

EXPERIMENT

I want to try an experiment and I'm willing to spend $50 on it. I am running a "contest", if you can call it that. I am trying to see how quickly I can get 30,000 unique visitors to this 'basically empty site' by offering a small amount of money to one lucky 'winner'.
Here how it works.
All you have to do is enter your email address and click submit. It can be address that goes to your garbage mail or wherever. I am really not interested in the address. I will be counting unique IP addresses to this site, or however google analytics categorizes unique visitors. Once the 30,000 mark is hit, I will randomly choose one of the people and email them that they won. They'll let me know how they want me to pay them. Paypal, check in the mail, or whatever other method they so choose.
Here's the catch. How can I prove that I'll actually send the money to the 'winner'. I can't. I give my word, but that's it. If you don't want to enter an email address, no problem, You can click away from this 'site' the same way you came. This is an experiment and if it fails, so be it. I also give my word that I will not use your email address for any other purpose other than to let you know you've won.
Also, you should know that I don't expect to ever reach the 30,000 mark. I we reach it, I'll pay out, but I doubt it'll ever come to that. That's why it's an experiment. Experiments usually fail.
If you decide to trust me, or you have an address where all the garbage email goes to anyway, enter it here. Please tell others about this page, so that we can reach the 30,000 mark quickly. If you have any ideas how I can let people know about this page, you can enter it in the comment box.

SQL Basics - Creating and Changing Tables (Last Lesson)

2008-02-05T10:08:00.000-05:00

Up until now, we dealt with retrieving, inserting, and manipulating data. Today, we'll discuss manipulating the table itself.

CREATING A NEW TABLE

To create a new table, we use the CREATE TABLE clause. When we create the table, we must specify the name of the new table, and the name and datatypes of the columns, with each column separated by a comma. For example, to creat the table 'OrderItems' that we've been working with, we do the following:

CREATE TABLE OrderItems
(
order_num INTEGER NOT NULL,
order_item INTEGER NOT NULL,
prod_id CHAR(10) NOT NULL,
quantity INTEGER NOT NULL DEFAULT 1,
item_price DECIMAL(8,2) NOT NULL
)

As you can see, we specified the datatype, and if it allows a NULL value or requires you to givwe a value. You can also define a default value, as we've done with the quantity column. This creates the table we have used in this tutorial.

CHANGING AN EXISTING TABLE

To make changes to an existing table we use the ALTER TABLE clause. Different applications have very different rules as to when you're allowed to alter a table, and with what information. Refer to your application documaentation for your specific case. If and when you do add a column to the table, here's how it's done:

ALTER TABLE Orders
ADD payment_method CHAR(20);

and when your boss is ready to kill you for what you did, you can remove a column:

ALTER TABLE Orders
DROP COLUMN payment_method;

Now your boss is ready to fire you for wasting time, so you can really mess him up by deleting the whole table:

DROP TABLE Orders;

That's by far the easiest thing to do so far. I wonder why that is. The guy that wrote this language must've have loads of scores to settle.

THERE IS MUCH MORE TO THE SQL LANGUAGE. BUT I THINK FOR NOW WE'LL LEAVE IT AT THIS. WE WILL BEGIN SQL INJECTION SOON. BUT FIRST I WOULD LIKE TO WRITE ABOUT SETTING UP OUR OWN SQL SERVER SO THAT WE CAN PRACTICE SQL INJECTION WITHOUT GETTING ARRESTED. THEY PROBABLY WOULD BLOCK THIS BLOG FROM JAIL COMPUTERS. WE'LL BE IN TOUCH REAL SOON.

SQL Basics - Changing and Deleting Data

2008-02-04T11:43:00.000-05:00

Last post we discussed adding a new entry into a table. Today I want to talk about updating previous data, or deleting it. It's actually quite simple. To update, we use the UPDATE clause. Cool, isn't it? Our customer, Fun4all moved, and we want to change his address.

UPDATE Customers
SET cust_address = '123 Drunk Drive'
WHERE cust_id='100000003'

This replaces the customer's old address, 1 Sunny Place, with his new address.

WARNING!!! WARNING!!! WARNING!!! WARNING!!!

If I had left out the WHERE clause, this query would have gone through without a problem, except that now all my customer's addresses are '123 Drunk Drive'. You must make sure to use the WHERE clause.

If we need to change his city and zip too, we can use the same query qith the new fields separated by commas.

UPDATE Customers
SET cust_address = '123 Drunk Drive',
cust_city = 'Jailcell',
cust_zip = '07734'
WHERE cust_id='100000003'

To delete data is even easier, using the DELETE clause. Fun4all moved and isn't buying from us ever again, that loser. Let's take him out of our database.

DELETE FROM customers
WHERE cust_id = '100000003'

Here again we must be careful to use the WHERE clause, or we just erased our whole customer base. Not a good move.

Next time we'll discuss changing the table itself, and creating new tables.

SQL Basics - Inserting Data into a Database

2008-02-04T00:55:00.001-05:00

Up until now, we dealt with retrieving data. Now we're going to discuss inserting and updating the database data. If we just want to add a record to the table, we use the INSERT clause, or INSERT INTO. There are basically two syntaxes that can be used. I will describe both ways.

INSERT INTO Products
VALUES ('BNBG04','DLL01','Monkey bean bag toy',4.49,'Cute monkey toy that your kids will love')

This will add a full new record to our Products table. When using this simple format, you must specify a value for all columns in the table. If you don't have a value to enter, you must enter it as NULL.

There is another format that you can use, and it is more recommended, although a bit more tedious.

INSERT INTO Products(prod_id,vend_id,prod_name,prod_price,prod_desc)
VALUES ('BNBG05','DLL01','Monkey bean bag toy',4.49,'Cute monkey toy that your kids will love')

The difference here is that we provided the column names that we are inserting to. This is recommended because then the values don't have to be in the order of the columns in the table, so if the table changes a bit, the insert will still work correctly. Also, if we explicitly state the column names, we can leave out some columns if we have no info for those columns. For example, if we don't have a product description we just leave it out of the column list and the values list.

There is another useful way to use INSERT INTO, and that is together with a SELECT clause. It automatically inserts the data retrieved from a SELECT query. Here's an example. We have products in another table names otherProducts and we would like to import it into our Products table. Here's how it's done

INSERT INTO Products

(prod_id,vend_id,prod_name,prod_price,prod_desc)

SELECT(prod_id,vend_id,prod_name,prod_price,prod_desc)

FROM otherProducts

One more thing for this lesson. If we want to copy results of a query into a brand new table, we use SELECT INTO. For example, to create a table with all products below $7.00, we would do this:

SELECT *

INTO newtable

FROM Products

WHERE prod_price<7.00

And get this:

SQL Basics - Combining Queries Using UNION

2008-02-03T01:41:00.001-05:00

Many times you have two queries that you want to make, but you want the results all in one table. You can do it with the OR function in the WHERE clause, but you can also use unions. Why not just use OR? Well, if you are retrieving the data from two different tables containing similar data, such as sales from two different years. You can't use joins, because there are no connecting columns. What do you do now? Use Unions. It's very simple. You take your 2 SQL queries, or 10 SQL queries and put the word UNION in between. Such as.:

SELECT prod_name, vend_id
FROM Products
WHERE vend_id='DLL01'
UNION
SELECT prod_name, vend_id
FROM Products
WHERE vend_id='BRS01'

As stated above, you can connect two different tables, even if they don't contain the same columns. For example:

SELECT prod_name, vend_id FROM Products WHERE vend_id='DLL01'

UNION

SELECT cust_name, cust_address FROM Customers

ORDER BY 1

Now why you want to do what I just did is beyond me, but at least you see it works.

BEWARE OF THE RULES INVOLVED:

1. All the queries must contain the same number of columns for the output, or you'll set an error message.

2. The columns that are part of the UNION must be of similar datatype, such as both test, both number, both numeric, etc. (this is what is exploited in SQL injection to get nice error messages.)

The UNION operator automatically filters out duplicate entries. How about if you had one table containing orders from 2007 and one from 2008 and you filtered by name. The duplicate order would be filtered out, which is not acceptable. For this we use UNION ALL. It is used the same way as UNION, and it returns all entries including duplicates.

See you next time.

SQL Basics - Using Joins

2008-02-03T00:34:00.001-05:00

What are joins? We explain in last post (Subqueries) what relational databases are. Basically, there are many different groups of data stored in many different tables. We used subqueries to filter data based on multiple tables. Now what if we need to retrieve data from multiple tables. Well, we can do many select squeries with many subqueries and add them all together. But there must be an easier way. That is what we use joins for. What joins do is virtually connect all the tables based on the columns that connect them, so that for our application we treat it as one big table.

Creating a join is very similar to what we've been doing up until now. Two things change. In the FROM clause, we put in all the table names that we're using. Second, we must match the columns with a WHERE statement. For example:

SELECT OrderItems.order_num,OrderItems.prod_id,Vendors.vend_name
FROM OrderItems,Vendors,Products
Where OrderItems.prod_id=Products.prod_id AND Products.vend_id=Vendors.vend_id;

What we did is use a WHERE clause to join the columns by showing which columns connect them. Then in the FROM clause we included all the tables we're working with.

You'll realize something else new here. I have the columns fully qualified, meaning tablename.colname . Being that we're using multiple tables and they share column names, we must tell the SQL application which column we mean, or you'll get an error message. Take a look at the example we gave in subqueries. Can you see how much simpler it would be using joins.

To further simplify our job, we can use aliases (which we discussed in a previous post). Using the above example, here's how we would do it.

SELECT O.order_num,O.prod_id,V.vend_name
FROM OrderItems AS O, Vendors AS V,Products AS P
Where O.prod_id=P.prod_id AND P.vend_id=V.vend_id;

We named each column by their initial, and that made life a lot easier, or at least this query easier. There is more to be written about joins, but this will suffice for us. The other types are much more advanced and won't be used in your regular playing around, especially in SQL injecting. Did you forget that that's out real goal here?

SQL Basics - Using Subqueries

2008-01-31T23:40:00.001-05:00

Most databases use relational tables. What that means is that the data is not stored all in one table. It is split up into various tables. For example , one table would contain customer information, one would contain the order numbers, one would contain the products ordered, and yet another would contain the store products. All the tables are related in some way. The order table would have a column containing the customer that made it, and the order products table would have a column containing the order number it refers to.

To show an example, we'll use our good old database that we obtained at the beginning of this course. Let's say you have a recall on the Rabbit bean bag toy. It's a terrible choking hazard for little children. We now need to send a return envelope to all the customers that purchased it.

These are the steps we need to do.

1. Get the product ID of the rabbit bean bag toy from the Products table.

2. Get the orders that contain that item number from the OrderItems table.

3. Get the customer ID of the companies that made those orders from the Orders table.

4. Get the mailing information of those Customer IDs.

Now here's how we do it using subqueries, or nested SELECT queries.

SELECT (RTRIM(cust_name) + ' ' + RTRIM(cust_address) + ' ' + RTRIM(cust_city) + ', ' +RTRIM( cust_state) + ' ' + RTRIM(cust_zip)) AS 'Recall Candidates'

FROM Customers WHERE cust_id IN

(SELECT cust_id FROM Orders WHERE order_num IN

(SELECT order_num FROM OrderItems WHERE prod_id=

(SELECT prod_id FROM Products WHERE prod_name='Rabbit bean bag toy')))

If you follow through the SQL code, you will see that we have all those 4 steps nested one in the other. The outcome is below:

We used the RTRIM function to remove some of the spaces contained in the database. We used the AS function to name the outcome, as you can see atop the results table. We also used the IN function to choose multiple returned customers.

Next time we will learn a better way to do this when dealing with so many tables. We'll learn how to use JOINS. Until next time, keep warm.

SQL Basics - Grouping Data

2008-01-31T13:05:00.000-05:00

We previously learned now to use aggregate functions to rerieve the average of a column or of entries matching a specific condition filtered with WHERE. Now we will learn how to get all the averages of the table grouped by a column entry. For example, you are a teacher with 20 kids in your class. Each student took six exams and you want ot get each child's average. You can use AVG() and WHERE student_name='whatever', but you would have to do it 20 times for all your students. Here's where grouping comes into play.
SELECT AVG(test_score) FROM table_tests
GROUP BY student_name
Another example. Using our old database we'll get the sum of each order in a separate entry.
SELECT order_num, SUM(quantity*item_price) FROM OrderItems
GROUP BY order_num

How about if we want to get a list of all students with an average below 65. We would think to use the WHERE clause, but it won't work. WHERE filters rows only, not groups. For groups, we use the HAVING clause.
SELECT AVG(test_score) AS average
FROM table_tests
GROUP BY student_name
HAVING average <>
One more thing to note. If you were to have all your classes in one table and you wanted the average of all failing students from just your Grade 6 class, here's how you'll do it:
SELECT AVG(test_score) AS average
FROM table_tests
WHERE column_grade = 6
GROUP BY student_name
HAVING average <>
ORDER BY student_name
Notice I used ORDER BY to sort the data, because although GROUP BY groups the data by name, it will not necessarily be in alphabetical order. Note that the clauses must actually be in the above order. SELECT...FROM...WHERE...GROUP BY...HAVING...ORDER BY

SQL Basics - Using Functions (cont.)

2008-01-31T09:57:00.000-05:00

Today we're going to talk about some more text manipulation functions that are a bit tricky to get right. The reason being that each application has different syntax for these functions. I will post all the different syntaxes for the popular programs and will indicate in a chart which syntax each program uses.

CONCATENATE

We already spoke about Concatenating, but I bring it up because the chart will tell us which syntax your program uses.

1. SELECT col1 col2 FROM tablename WHERE .....

2. SELECT col1 + col2 FROM tablename WHERE .....

3. SELECT CONCAT(col1,col2) FROM tablename WHERE .....

_________________________________________________

SUBSTRING

This function is similar to the LEFT and RIGHT function we learned about in last lesson. Except it takes a string from in middle of another string. For example, to take the third and fourth letter of the string in the column, we would enter it so:

1. SELECT SUBSTRING(colname FROM 3 FOR 2) FROM tablename WHERE .....

2. SELECT SUBSTR(colname,3,2) FROM tablename WHERE .....

3. SELECT MID(colname,3,2) FROM tablename WHERE .....

4. SELECT SUBSTRING(colname,3,2)FROM tablename WHERE .....

_________________________________________________

UPPER CASE

To retrieve the results all in upper case format, we use this command:

1. SELECT UPPER(colname) FROM tablename WHERE .....

2. SELECT UCase(colname) FROM tablename WHERE .....

_________________________________________________

LOWER CASE

To retrieve the results all in lower case format, we enter it like this:

1. SELECT LOWER(colname) FROM tablename WHERE .....

2. SELECT LCase(colname) FROM tablename WHERE .....

_________________________________________________

POSITION OF SUBSTRING IN STRING

To retrieve the position of a substring in a string, we use the SUBSTRING function. This is especially useful when finding out where a space is located to retrieve just the first word. To do that, we enter:

1. SELECT POSITION(' ' IN colname) FROM tablename WHERE.....

2. SELECT INSTR(colname, ' ') FROM tablename WHERE.....

3. SELECT CHARINDEX(' ',colname) FROM tablename WHERE.....

_________________________________________________

There are many more such functions, but these are the most important ones, especially if we're dealing with SQL injection. The following is a chart of the major Database applications and which syntax they use, using the numbered syntaxes above.

	Concatenate	Substring	Upper Case	Lower Case	Position
SQLite	1	1	1	1	1
DB2	1	2	1	1	1
Access	2	3	2	2	2
PostGres	1	1	1	1	1
Oracle	1	2	1	1	2
SQL Server	2	4	1	1	3
MySQL	3	1	1	1	1
Mimer	1	1	1	1	1
Sybase	1	4	1	1	3

We'll speak....

SQL Basics - Using Aggregate Functions

2008-01-30T23:38:00.000-05:00

AGGREGATE FUNCTIONS
Aggregate functions are used to summarize values, such as getting the sum of many rows, the average, etc. Let's go through the most used functions.

AVERAGE
AVG() is used to get the average of a collection of rows.

Usage: SELECT AVG(colname) FROM ..... [WHERE...]
_________________________________________
COUNT
COUNT () is used to return the number of rows in a given column or rows that are defined in a WHERE clause.

Usage: SELECT COUNT(colname) FROM ..... [WHERE...]

Using the above syntax will return the number of rows that don't have a NULL value. To return the full number of rows including rows with a NULL value use:

SELECT COUNT(*) FROM .....
_________________________________________
MAX
MAX() is used to get the greatest value in the column or defined rows.

Usage: SELECT MAX(colname) FROM ..... [WHERE...]
__________________________________
MIN
MIN() returns the lowest value in the column or defined rows.

Usage: SELECT MAX(colname) FROM ..... [WHERE...]
_________________________________________
SUM
SUM() Returns the sum of the column or the defined rows.

Usage: SELECT SUM(colname) FROM ..... [WHERE...]

SQL Basics - Using Functions (Text Manipulation)

2008-01-30T19:54:00.000-05:00

We really started working with functions in the last post using concatenation. Today we'll discuss one of two types of functions. The first is string manipulation functions, which concatenation is part of. The second category is the aggregate functions, which summarizes values, such as sums and averages. This second function will be discussed in the next post.

STRING MANIPULATION FUNCTIONS

LTRIM

This function is used to remove all spaces to the left of the table entry. For example, if the entry was ' hello', we only want the word 'hello to be returned, and to do this we use LTRIM.

Usage: SELECT LTRIM(colname) From .....
________________________________________

RTRIM

This function is used to remove all spaces to the right of the table entry. For example, if the entry was 'hello ', we only want the word 'hello to be returned, and to do this we use RTRIM

Usage: SELECT RTRIM(colname) From .....
___________________________________

LEFT

This function is used to return a specified number of characters starting at the left of the table entry. This is useful if a column of Zip Codes are saved in 00000-0000 (for you USA'ers) format and we only want the first five digits. For this we use LEFT

Usage: SELECT LEFT(colname,5) From .....
___________________________________

RIGHT

This function is used to return a specified number of characters starting at the right of the table entry. If we wanted to get the last 4 digits of a Social Security number (also for you USA'ers), you would use the RIGHT function.
Usage: SELECT RIGHT(colname,4) From .....
___________________________________

LEN

This function simply gets the length of the specified entry. For example, to get the lenght of a user's password, we use LEN.
Usage: SELECT LEN(pass_word) From .....

SQL Basics - Sorting Your Results

2008-01-30T15:47:00.001-05:00

To sort your results returned from a SELECT command,we use the ORDER BY clause.

SYNTAX

SELECT * FROM table_name [WHERE condition]

ORDER BY column-name(s)

EXAMPLES

SELECT * FROM TeethEyes

ORDER BY child_age

You can also sort text in alphabetical order.

SELECT * FROM TeethEyes

ORDER BY child_Eyes

How about if you want to sort in a descending order, such as the older child first. You use the DESC parameter.

SELECT * FROM TeethEyes

ORDER BY child_age DESC

One last thing. You can sort by multiple columns, and have it sort first by one and then the other, for example:

SELECT * FROM TeethEyes WHERE child_teeth>3

ORDER BY child_eyes, child_age DESC

First it sorted by the eye color in ascending order, then it sort by age in descending order.

We'll be in touch.

SQL Basics - Using Wildcards With The LIKE Operator

2008-01-30T09:00:00.000-05:00

If you've worked with computers you know about wildcards. In Windows '*' stands for an indefinite number of characters and '?' means one character. You can do a similar representation in SQL WHERE statements. In most SQL applications the '*' is replaced with '%' and the '?' is replaced by the '_' (underscore) symbol. In Microsoft Access you must use the standard wildcards, * and ?. The way we use it is with the LIKE operator:

SELECT * FROM column_name WHERE LIKE '__sample*'

What the above example does is find entries in column_name that have any two characters, then the word 'sample', then whatever else.

Here are some examples of the syntax:

SELECT child_name FROM TeethEyes

WHERE child_name LIKE '__rr%';

In Access you would type: WHERE LIKE '??rr*'

Here's another example:

SELECT child_name FROM TeethEyes

WHERE child_name LIKE '%y';

IMPORTANT NOTE: I think I failed to mention all along the difference when entering text strings or entering numbers. When entering text in the WHERE clause, the text is surrounded by 's. such as 'this'. Numbers are entered without the apostrophes. I'll edit the first WHERE post to note this there too.

SQL Basics - Calculated Fields and Aliases

2008-01-29T23:13:00.001-05:00

Very often you will find that you need to display data not in it's original form. Such as totals, averages, or multiples, or just reformatted. We can usually do it with the application we're using, but it is more efficient to do it using SQL. What happens is that SQL creates a virtual column containing your calculated field.

Here are some of the most used operators.

CONCATENATION

This operator takes two or more strings and connects them into one long string. For this we use the '+' symbol in MS Access and some others. In some programs '||' is used (two straight up lines.)

EXAMPLE

SELECT child_name + child_eyes FROM TeethEyes;

Not extremely readable, is it? Here's what we can do to help that

SELECT child_name + ' has ' + child_eyes + ' eyes.' FROM TeethEyes;

That's a little better.What we did is add the name, ' has ', which is a space, the word has ans a space. Then we added the eye color, a space and eyes. Pretty simple.

MATHEMATICAL FORMATTING

You can also use the '+' symbol on numbers to add them together. For that matter, you can use all 4 regular operators (+,-,*,/).

EXAMPLE

SELECT (quantity*item_price) FROM OrderItems WHERE order_num=20005

That's the number of items ordered multiplied by the price of the items, for order number 20005. If we want to get the total price for the order we would have to use SUM(), which we'll hopefully learn more about in another lesson.

SELECT SUM(quantity*item_price) FROM OrderItems WHERE order_num=20005

If you noticed, the column name in the past few pictures was Expr1000. That's the name automatically given to the virtual column by SQL. Sometimes we need to name the column so that our application can work with it. For this we use aliases, by adding the AS parameter.

SELECT SUM(quantity*item_price) AS order_total FROM OrderItems WHERE order_num=20005

As you see, now our virtual column has a name order_total, and as far as our application knows, it's a regular real column to work with.

Sorry for the mess up

2008-01-29T20:54:00.000-05:00

For a few hours today this blog was a mess. It was due to a tag I added to try to make it neater, and it went haywire, especially if you were using Mozilla. It's fixed and running as good as ever. Sorry again to all my readers.

SQL Basics - The WHERE Clause (AND OR and IN)

2008-01-29T15:28:00.001-05:00

CHECKING FOR MULTIPLE CONDITIONS

In last lesson we learned about the WHERE clause used to filter the results. How about if you wanted to filter the results further so that the output matches in two aspects. For this we use the AND operator. For example:

SELECT prod_name FROM Products
WHERE vend_id='BRS01' AND prod_price<9;

This returns:

It returned only the name of the products that are from vendor BRS01 and that are priced under $9.00.

___________________________________________________

CHECKING FOR ONE OF MULTIPLE CONDITIONS

Now if we wanted to retrieve items that match one of various conditions, we would use the OR operator, like this:

SELECT * FROM OrderItems
WHERE quantity>50 OR item_price>10;

Here's what you get:

You can also use both AND and OR together. The AND will get processed first, and the OR second, so to use the OR first use parentheses, as shown below.

SELECT * FROM TeethEyes WHERE child_age<6 AND child_eyes='Gray' OR child_eyes='Brown'

SELECT * FROM TeethEyes WHERE child_age<6 AND (child_eyes='Gray' OR child_eyes='Brown')

In the first case we didn't use parentheses. It returned all entries that match either a child under 6 with brown eyes, or a child with gray eyes. In the second case, it returned children under 6 that have either Gray or Brown eyes.

___________________________________________________

A similar operator is the IN operator. It works almost the same as OR, with a different syntax.

SELECT * FROM TeethEyes
WHERE child_age IN(8,1,10)

___________________________________________________

Before we close out for the day, I'll mention two more operators, NOT and IS NULL. NOT works almost the same as'<>', only it comes before the column name.

SELECT vend_name,vend_country FROM Vendors
WHERE NOT vend_country='USA'

IS NULL checks for a NULL value in the given column. In our Vendors table, foreign companies don't have states listed so this is the result.

SELECT vend_name,vend_country FROM Vendors
WHERE vend_state IS NULL

SQL Basics - The WHERE Clause

2008-01-28T20:22:00.001-05:00

The WHERE clause is used to filter through the table and extract only the rows you want.

BASIC SYNTAX

SELECT column FROM table

WHERE column operator value

EXPLANATION

You already know what SELECT and FROM is, the new part is:

WHERE column operator value

What WHERE does is tell the SELECT Statement to only select the entries from the table that match a certain criteria. Let's give an example and then we'll explain it a bit more. Using our database we'll issue the following command

SELECT prod_id, prod_name FROM Products
WHERE vend_id='BRS01';

The output is shown below:

What'd we do? We selected the product ID and product name of the products whose vendor code is BRS01.

So WHERE column operator value means we write WHERE, the name of the column to check or 'vend_id', the operator which in our case was '=', and the value which was BRS01.

This is a list of the basic operators, although we will learn other ones in the future.

Operator	Description
=	Equal
<>	Not equal
>	Greater than
<	Less than
>=	Greater than or equal
<=	Less than or equal
BETWEEN	Between an inclusive range

Here's some examples of these operators using the table 'TeethEyes', shown below:

SELECT child_name, child_age FROM TeethEyes
WHERE child_teeth>18;

returns:

SELECT child_name FROM TeethEyes
WHERE child_age<=8;

returns:

Harry

Barry

Kari

And finally,

SELECT child_name,child_teeth,child_eyes FROM TeethEyes WHERE child_age BETWEEN 4 AND 9;

returns:

The WHERE statement is almost always used, and will be used extensively in SQL injection. Make sure you've got it so far.

Opening Database and Sending Queries

2008-01-28T12:57:00.001-05:00

Here are the instructions on how to set up you're own practice range for SQL learning. I am going to write the instructions using Microsoft Access, because that is what I am using. You may want to use something else, especially if you're using Linux. There is a free Java based SQL client called Aqua Data Studio. It can be downloaded at http://www.aquafold.com/. If you go with that option, read up on their website about how to get started.

If you are using Microsoft Access, then read on:

You should already have the database downloaded from 2 posts ago, or find any other MS Access database online to use as a practice DB.

1. Click on the .mdb file you downloaded to open MS Access and the database. It will open with a smaller window inside that look like this:

Select 'Queries' from the side menu. Then click on 'New' from the top menu. In the 'New Query' popup, select 'New Design' and press OK. In the next popup, 'Show Table', press 'Close'.

Go to the 'View' menu on top, and select 'SQL View'.

In the window that opens is where you'll be doing you're magic. Access already puts in the SELECT statement because that is usually what you'll be using. When you finish typing your SQL query, you'll press the red exclamation mark on top to run it.

The output will be displayed in a new window. To go back to your SQL query, you'll choose SQL View again from the 'View' menu.

Now that you have the battleground ready, let's get going.

Learning the Basics of SQL - Part One - The SELECT Statement

2008-01-27T23:17:00.001-05:00

Let's get straight down to business.

We'll start with the most often used statement:

THE SELECT STATEMENT:

Basic syntax:

SELECT column_name(s)
FROM table_name

--------------------------------------

For example (using the table Products in the previous post):

SELECT prod_name


FROM Products

Will return :

--------------------------------------

Or we can retrieve multiple columns such as:

SELECT prod_name, prod_price

FROM Products

and you'll get:

--------------------------------------

Or you can use wildcards and retrieve all the columns:

SELECT *
FROM Products

and you'll see:

In SQL, spaces don't count, and Enter presses don't either. Meaning that you can type:

SELECT * FROM Products

and get the same results.

Next we will discuss the WHERE clause. Before that, I will post instructions on how to open the database in Microsoft Access and send it SQL queries.

The Database On Which We'll Be Basing Our SQL Guide

2008-01-26T23:49:00.001-05:00

I quickly learned SQL from a book named Sams Teach Yourself SQL in 10 Minutes (3rd Edition) (Sams Teach Yourself). It's well written and simply put. If you want to get more information than I'll be putting up, and don't want to spend to much time, I would recommend this book. They based it on a database available on their website. I don't know if they only let you download if you own the book, but it's available here:

www.forta.com/books/0672325675

I will also post the tables below, so that if you're not going through the guide hands-on, at least you'll be able to follow the outcomes.

Table named 'Customers':

cust_id	cust_name	cust_address	cust_city	cust_state	cust_zip	cust_country	cust_contact	cust_email
1000000001	Village Toys	200 Maple Lane	Detroit	MI	44444	USA	John Smith	sales@villagetoys.com
1000000002	Kids Place	333 South Lake Drive	Columbus	OH	43333	USA	Michelle Green
1000000003	Fun4All	1 Sunny Place	Muncie	IN	42222	USA	Jim Jones	jjones@fun4all.com
1000000004	Fun4All	829 Riverside Drive	Phoenix	AZ	88888	USA	Denise L. Stephens	dstephens@fun4all.com
1000000005	The Toy Store	4545 53rd Street	Chicago	IL	54545	USA	Kim Howard

Table named 'Orders':

order_num	order_date	cust_id
20005	5/1/2004	1000000001
20006	1/12/2004	1000000003
20007	1/30/2004	1000000004
20008	2/3/2004	1000000005
20009	2/8/2004	1000000001

Table named 'OrderItems':

order_num	order_item	prod_id	quantity	item_price
20005	1	BR01	100	$5.49
20005	2	BR03	100	$10.99
20006	1	BR01	20	$5.99
20006	2	BR02	10	$8.99
20006	3	BR03	10	$11.99
20007	1	BR03	50	$11.49
20007	2	BNBG01	100	$2.99
20007	3	BNBG02	100	$2.99
20007	4	BNBG03	100	$2.99
20007	5	RGAN01	50	$.4.49
20008	1	RGAN01	5	$4.99
20008	2	BR03	5	$11.99
20008	3	BNBG01	10	$3.49
20008	4	BNBG02	10	$3.49
20008	5	BNBG03	10	$3.49
20009	1	BNBG01	250	$2.49
20009	2	BNBG02	250	$2.49
20009	3	BNBG03	250	$2.49

Table named 'Products'

prod_id	vend_id	prod_name	prod_price	prod_desc
BNBG01	DLL01	Fish bean bag toy	$3.49	Fish bean bag toy, complete with bean bag worms with which to feed it
BNBG02	DLL01	Bird bean bag toy	$3.49	Bird bean bag toy, eggs are not included
BNBG03	DLL01	Rabbit bean bag toy	$3.49	Rabbit bean bag toy, comes with bean bag carrots
BR01	BRS01	8 inch teddy bear	$5.99	8 inch teddy bear, comes with cap and jacket
BR02	BRS01	12 inch teddy bear	$8.99	12 inch teddy bear, comes with cap and jacket
BR03	BRS01	18 inch teddy bear	$11.99	18 inch teddy bear, comes with cap and jacket
RGAN01	DLL01	Raggedy Ann	$4.99	18 inch Raggedy Ann doll
RYL01	FNG01	King doll	$9.49	12 inch king doll with royal garments and crown
RYL02	FNG01	Queen doll	$9.49	12 inch queen doll with royal garments and crown

Table named 'Vendors'

vend_id	vend_name	vend_address	vend_city	vend_state	vend_zip	vend_country
BRE02	Bear Emporium	500 Park Street	Anytown	OH	44333	USA
BRS01	Bears R Us	123 Main Street	Bear Town	MI	44444	USA
DLL01	Doll House Inc.	555 High Street	Dollsville	CA	99999	USA
FNG01	Fun and Games	42 Galaxy Road	London		N16 6PS	England
FRB01	Furball Inc.	1000 5th Avenue	New York	NY	11111	USA
JTS01	Jouets et ours	1 Rue Amusement	Paris		45678	France

These are the tables we'll be working with as we progress through the lessons. Looking forward.

An Introduction to SQL itself

2008-01-25T01:51:00.001-05:00

Before we really start with SQL Injection, I think it is imperative that we first understand the SQL syntax on a basic level. I just finished reading a book Sams Teach Yourself SQL in 10 Minutes (3rd Edition) (Sams Teach Yourself).I must admit it took me quite a bit longer than 10 minutes, but it was definitely manageable. I skimmed through a big chunk and just got the needed information, which I will share with you. It will take me a few days to post the introduction, and only then will we continue with injections. (P.S. I only read the introduction afterwards. 10 minutes means it's split into 10 minute lessons.)

As I posted before, my computer was shipped out to be repaired. The screen has to be replaced. I was playing with an old laptop I have and got it working again. Anyway, I discovered a program called "Windows Live Writer", a free program from Microsoft. It let's you write up your posts offline and just upload it when ready. Hopefully it will help me make my posts a little neater, but don't bet on it.

We'll be in touch!!!

TheNewbieHacker.com is up and running

2008-01-23T19:53:00.001-05:00

I finally had a chance to register and setup a new name. It's thenewbiehacker.com . It it just a link that takes you to the blog. Hopefully, it's a little easier to remember than the old n00bhacker.blogspot.com. Enjoy.

P.S. I am in the middle of reading a book on SQL so that I can understand and explain everything needed to know for SQL injection. Hopefully, by Sunday I'll be starting to post the whole topic in depth and with extreme clarity.

Sorry for being a little slow

2008-01-23T10:33:00.000-05:00

If you're anything like me, once you start learning something you can't get enough and don't have patience to wait for more. I understand and I apologize. First of all, for all those who commented that they want a writeup on WAP hacking, I'll post it after I finish with SQL injecting. I am reading a whole bunch of different sources to try to get the simples and most accurate information regarding SQL injection, and it's going to take a little more time. Also, my laptop screen backlight decided to die on me. I have it covered by PSP at Best Buy, but I was there yesterday and they told me it'll take about 3 weeks to get back. Get lost. I can't live that long wihtout my computer. We'll have to see what I can do. Untill then, I can still post through other means, but researching got a lot harder. I wouldn't want to test these things off someone else's computer. if you know what I mean. I'll try to get the information tested and posted as soon as possible. We'll speak.