45. Practice Exercises with Hints
45.4 Web Servers and MySQL – Build and Protect
Apache/Nginx document root, nginx -t / apachectl configtest before reload. MySQL: keys, SQL_SAFE_UPDATES, never public RDS/3306.
| Exercise | Task | Hint |
|---|---|---|
| E1 | Change Nginx root to /var/www/sahyadri and test config before reload |
sudo nginx -t then sudo service nginx reload |
| E2 | Create DB rajarani, table orders, insert 3 rows, SELECT with WHERE |
Primary key on id; never delete without WHERE in production habits |
| E3 | Show why string-concat SQL in PHP is dangerous (write bad vs good sketch) | Bad: "... WHERE id=$id"; good: prepared statements |
| E4 | Explain DELETE vs TRUNCATE vs DROP in one line each | Rows / empty table keep structure / remove table |
| E5 | GRANT: create MySQL user zoya with SELECT-only on one DB |
Least privilege – app user ≠ root |
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
SQLi via ' OR '1'='1 on login (OWN DVWA) |
Prepared statements; input allow-lists; WAF as extra layer |
| Finds phpMyAdmin on public IP | VPN / SSH tunnel; IP allow-list; disable when unused |
Ravindra Bagale's Tip
Students root ne app connect kartat. Interview: "app DB user = least privilege". He gold aahe. Ghabru naka – practice GRANT.
Lab
On OWN EC2 MySQL: create sahyadri DB, user appuser with password you set, GRANT SELECT,INSERT,UPDATE on that DB only. Login as appuser and prove DROP DATABASE fails. Screenshot.