The editor holds the query that a login form builds. The app pastes the username box between the first pair of quotes and the password box between the second pair. You play the attacker first: change only the text between the quotes.

1. Run the query. How many rows come back for the password guess?
2. Replace only guess with an input that returns every user.
3. Put guess back. Replace only ava with an input that logs you in as admin, and no one else. The password stays guess.
4. Now fix the app. Create a prepared statement named login with two text parameters: the same query, with $1 for the username and $2 for the password.
5. Log in as ava with the password kraken123 through login.
6. Send the attack of task 2 through login as ava's password. How many rows come back?