Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the address bar, nothing happens:' or 68 = '66; DROP ALL TABLES; --

I don't see why this isn't working. What is the correct text I must enter into the address bar to drop all the tables (and yes, I am testing this on a backup copy of the site)?

share|improve this question
PHP and MySQL? What API do you use? – Gumbo Apr 7 '13 at 16:18
@Gumbo, sorry, yes PHP and MySQL with mysqli. – Pamela Apr 7 '13 at 16:39
Well, in case you use mysqli_query, you’re probably not allowed to execute multiple statements at once. You would need mysqli_multi_query instead. – Gumbo Apr 7 '13 at 16:44
up vote 13 down vote accepted

The vast majority of web applications do not allow query stacking. With PHP/MySQL application can allow for query stacking if you use the mysqli::multi_query()or mysqli_multi_query() functions.

You can exploit these systems using sub-select, union-selects, blind sql injection, into outfile, or loadfile(). Sqlmap is a great tool for automating these attacks.

share|improve this answer
I'm also rather fond of the tool 'Havij' which is quite simply 'Aim and Fire' in most cases – NULLZ Apr 11 '13 at 14:51

If the site does not use apostrophes (') you can try this:; DROP ALL TABLES; --
share|improve this answer
It is still not working. It just displays the page as is. – Pamela Apr 7 '13 at 16:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.