Added S-30

Author: harsh-bothra

README.md

@@ -47,6 +47,8 @@ S.No. | Topic
 **26** | [Vulnerable Code Snippet - 14](/resources/vulnerable-code-14.md)
 **27** | [Vulnerable Code Snippet - 15](/resources/vulnerable-code-15.md)
 **28** | [Vulnerable Code Snippet - 16](/resources/vulnerable-code-16.md)
+**29** | [Vulnerable Code Snippet - 16](/resources/vulnerable-code-17.md)
+**30** | [Vulnerable Code Snippet - 16](/resources/vulnerable-code-18.md)
 
 
 # SecurityExplained NewsLetter

media/code-18.jpg

@@ -0,0 +1,19 @@
+### SecurityExplained S-30: Vulnerable Code Snippet - 18
+
+#### Vulnerable Code: 
+
+![Vulnerable Code](../media/code-18.jpg)
+
+
+#### Solution: 
+
+As per SonarSource, At line 9, the email is transformed to uppercase before its use in the SQL query. On Unicode characters, this process has the unintended effect that two distinct code points may result in the same one.
+
+It can be used to send the password reset token to another email and takeover accounts:  
+
+foo@mix.com -> FOO@MIX.com
+foo@mıhttp://x.com -> FOO@MIX.com
+
+Interesting Blog: https://t.co/UxdZJQxzc1
+
+##### Code Credits: SonarSource