test

<?php
require 'vendor/autoload.php';

$client = new MongoDB\Client("mongodb://localhost:27017");
$collection = $client->testdb->users;

// Function vulnerable to JavaScript injection via $where
function findUserWhere($collection, $username, $password) {
    $filter = [
        '$where' => "this.username == '$username' && this.password == '$password'"
    ];
    return $collection->findOne($filter);
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'];
    $password = $_POST['password'];

    // Vulnerable query using $where
    $userWhere = findUserWhere($collection, $username, $password);
    if ($userWhere) {
        echo "Welcome, " . htmlspecialchars($userWhere['username']) . "<br>";
    } else {
        echo "Invalid credentials<br>";
    }
}
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>NoSQL Injection Lab - $where Operator</title>
</head>
<body>
    <h1>NoSQL Injection Lab - $where Operator</h1>
    <form method="POST" action="">
        <label for="username">Username:</label>
        <input type="text" id="username" name="username"><br>
        <label for="password">Password:</label>
        <input type="password" id="password" name="password"><br>
        <button type="submit">Login</button>
    </form>
</body>
</html>