Note: In class we are using SQL Server 2000 Service Pack 4, Northwind Database, .NET 4
And the SQLInjection.zip folder that I have attached.
I just need some screen shots and a query string to complete this part.

1. Open the SQL Injection web page browsing to this web page:
Localhost/SQLInjection/SQLInjection.aspx
2. Enter the following value for the Customer Id and retrieve the information:
ALFKI
Observe the results. Print out the results and attach to lab report. Try to infer how this query might have been constructed by the program given the user input ALFKI.
The SQL query command was:
SELECT Orders.CustomerID, Orders.OrderID, COUNT (UnitPrice) AS Items,
SUM(UnitPrice*Quantity) AS Total FROM Orders
INNER JOIN [Order Details]
ON Orders.OrderID = [Order Details].OrderID
WHERE Orders.CustomerID = ‘ALFKI’
GROUP BY Orders.OrderID, Orders.CustomerID
Test it out by using the SQL Query Analyzer.
3. Now, to get you started, here is a sample SQL Injection data that will retrieve the information about all customers from the database. Enter the following in the Customer ID field and hit the submit button:
ALFKI’ or ‘1’=’1
Print out the query results and attach to the lab report. What is the query string for this query? Test it out by using the SQL Query Analyzer.