public class Calculator {
    public static int add(int a, int b) {
        return a + b;
    }
    public static void main(String[] args) {
        int result = add(10, 20);
        System.out.println("The sum is: " + result);
    }
}

main() মেথডে

• মেথড যোগফল হিসাব করে ৩০ রিটার্ন করেছে, যেটা result ভ্যারিয়েবলে সংরক্ষণ করা হয়েছে।

• শেষে System.out.println() দিয়ে “The sum is: 30” প্রিন্ট করা হয়েছে।

SELECT d.dept_name, AVG(e.salary) AS average_salary
FROM department d
JOIN employee e ON d.dept_id = e.dept_id
GROUP BY d.dept_name;

Cost: Implementing and maintaining a DBMS can be expensive due to the cost of software licenses, hardware, and skilled personnel needed to manage the system.

Complexity: DBMS systems are complex to design, implement, and manage. They require specialized knowledge, and the complexity can increase with the size and scale of the database.

Scalability: Some DBMSs may face challenges when scaling to handle very large amounts of data or high transaction volumes efficiently, especially with unstructured data.

Dependence on Technology: Organizations become dependent on the specific DBMS technology they use, which can cause problems if the vendor stops support or if migration to another system is needed.

Performance Issues: Under heavy loads or with complex queries, DBMS performance can degrade, leading to slower response times and potential bottlenecks.

Data Integration: Integrating data from multiple, heterogeneous sources into a single DBMS can be difficult and time-consuming, especially when data formats and structures differ.

Security: Although DBMSs provide security features, they can still be vulnerable to unauthorized access, hacking, and data breaches if not properly managed.

The features of SQL (RDBMS), NoSQL, and NewSQL,

CI/CD Development Model

SQL Injection SQL Injection is a type of attack where an attacker inserts malicious SQL queries into input fields, allowing them to manipulate or retrieve data from the database. This can result in unauthorized access, data theft, or even complete control over the database.Example: If a website uses the following SQL query to check login credentials:

        SELECT * FROM users WHERE username = 'input' AND password = 'input';

An attacker can input the following into the username or password field:

        ' OR 1=1 --

This will change the query to:

        SELECT * FROM users WHERE username = '' OR 1=1 -- AND password = '';

The condition `1=1` is always true, allowing the attacker to bypass the login and gain access to the application.

Cross-Site Scripting (XSS) XSS (Cross-Site Scripting) is a security vulnerability that allows attackers to inject malicious JavaScript code into a website's pages. This code is then executed in the browsers of users who visit the infected page, allowing attackers to steal sensitive data like cookies, session tokens, or even login credentials. Example: If a website allows a user to submit a comment like:

        <input type="text" name="comment" />

Without sanitizing the input, an attacker could submit the following as a comment:

        <script>alert('XSS Attack');</script>

If the website displays this comment without filtering out the <script> tag, it will execute the JavaScript code in the victim’s browser, potentially leading to a stolen session or a malicious redirect.

CSRF (Cross-Site Request Forgery) is a type of web attack where the attacker tricks the victim into unknowingly sending a forged request to a web application, using the victim’s authentication credentials (such as a session cookie). The forged request appears legitimate to the server, and the victim is typically unaware that their action (such as transferring funds or modifying account settings) has been hijacked by the attacker. In CSRF, the attacker doesn’t need to know the user’s secret information, but instead exploits the active session or authentication token to perform unauthorized actions.

Understanding CSRF (Cross-Site Request Forgery): A Comprehensive Overview

By using cross-site request forgery (CSRF), an attacker can force a victim's browser to send a request to a website where the victim has already authenticated (such as a bank site). Without requiring the victim's login credentials, the attacker can initiate actions such as money transfers if the victim clicks on a harmful link.

The Procedure for a CSRF Attack:

Victim Login and Establishing a Session:

A session is established when the victim logs into a website, such as a banking website. A Session ID, usually stored in a cookie on the victim's browser, is used to identify this session. During this session, the victim can access their account and remain logged in without having to enter their credentials again for every action (such as transferring money).

Attacker's Goal:

Now, the attacker’s goal is to transfer funds from the victim’s bank account without the victim’s direct interaction. This is carried out without being aware of the victim's login information, including their username, password, PIN, etc.

Creating a Malicious Request:

It is not necessary for the attacker to log in. Rather, they produce a malicious URL that causes the victim's bank account to be credited. Tricking the victim into clicking on this link is the attacker's aim.

In order to get the victim to click on the link, the attacker uses social engineering to send it to them via email, social media, or another channel.

How the Attack Works:

The victim's browser sends the request, along with the session cookie created when they logged in, to the bank's server when they click on the malicious link.

The request is handled by the server as though it were from the authenticated user because it trusts the session cookie.

Since the victim is already logged in, the server assumes it’s a legitimate request and transfers the funds from the victim’s account to the attacker’s account.

Preventing CSRF Attacks:

Token-Based Security (Anti-CSRF Token):

Many frameworks, including Django, use this robust defense. The concept is that a distinct, random CSRF token is included in every form or sensitive action (such as money transfers).

When a user requests a sensitive action or loads a form for the first time, the server creates this token. With every request, this token is returned as a URL parameter, HTTP header, or form field.

With every request, the server verifies this token. The request is deemed invalid and blocked if the token does not match the expected one.

The attacker has no access to the valid CSRF token. Since they cannot predict or generate the correct token, their malicious requests will be rejected by the server.

Referrer Header Verification:

The server is informed of the origin of the request by the Referrer Header. The server can determine whether the request is coming from a reliable source or an external (malicious) website by looking at the referrer.

For instance, a request may be blocked if it originates from a suspicious source, such as the attacker's website.