Dropping The Table

[Pain]

Not sure if it is a good place to ask, but I'll do it anyway.

 

if i have a following query:

 

$query2 = mysql_query("SELECT * FROM testas WHERE username = '$username');

 

How do i drop the table by injecting sql?

 

have tried this

x’; DROP TABLE testas; --

but nothing happened:D

Edited November 27, 2012 by Pain

[mrMarcus]

Where's Bobby tables when you need him...

[PFMaBiSmAd]

The mysql_query statement specifically doesn't support multiple queries because too many php 'coders' don't validate the external data they stuff into query statements.

[Pain]

What statement should i use instead of mysql_query. I want to test this injecton.

Edited November 27, 2012 by Pain

[Pikachu2000]

Are you testing security? If you are, why would you test it with anything other than what your code actually uses? If you use mysql_query(), that's what it should be tested with, and you've already verified that it failed to drop the table.

 

Disclaimer: if it's simply a learning exercise, the above is not applicable.

[Pain]

I would like to display this in my uni presentation:)

[PFMaBiSmAd]

Then why not re-search to find the php query functions that would allow multiple queries?