I am Web developer, but I don't understand something, I did search and asked many but they know it is just there but the don't give me a technical answer:

Main Question :

How SQL Injection works through URL with SQL in parameter?

Description :

Assume I have database and in the database I have table named mytable and when I get id from method POST I put it in this query

SELECT * FROM `mytable` WHERE id='POST[id]'

Even if user put SQL like  : SELECT * FROM 'mytable'

It became something like this:

SELECT * FROM `mytable` WHERE id='SELECT * FROM 'mytable'

So it just returns  :

You have an error in your SQL syntax

So I just think How these kind of attack works ?

  How they change the query to pass Syntax Error ?

I wonder how SQL injection works through URL with SQL in the parameter. Assume I have a database with a table named mytable. When I get an ID from method POST I put it in this query:

SELECT * FROM `mytable` WHERE id='POST[id]'

Even if the user puts SQL like:

SELECT * FROM 'mytable'

It became something like this:

SELECT * FROM `mytable` WHERE id='SELECT * FROM 'mytable'

So it just returns:

You have an error in your SQL syntax.

So how does this kind of attack work? How can the attacker change the query without causing a syntax error?

I am Web developer  , but i don't understand something  , i did search and asked many but they know it is just there but the don't give me a technical answer:

Main Question :

How SQL Injection works through URL with SQL in parameter  ?

Description :

Assume i have database and in the database i have table named mytable and when i get id from method POST i put it in this query

SELECT * FROM `mytable` WHERE id='POST[id]'

Even if user put SQL like : SELECT * FROM mytable`

It became something like this: SELECT * FROM mytable WHERE id='SELECT * FROM mytable' So it just return :

You have an error in your SQL syntax

So i just think How these kind of attack works ?

How they change the query to pass Syntax Error ?

I am Web developer, but I don't understand something, I did search and asked many but they know it is just there but the don't give me a technical answer:

Main Question :

How SQL Injection works through URL with SQL in parameter?

Description :

Assume I have database and in the database I have table named mytable and when I get id from method POST I put it in this query

SELECT * FROM `mytable` WHERE id='POST[id]'

Even if user put SQL like : SELECT * FROM 'mytable'

It became something like this:

SELECT * FROM `mytable` WHERE id='SELECT * FROM 'mytable'

So it just returns :

You have an error in your SQL syntax

So I just think How these kind of attack works ?

How they change the query to pass Syntax Error ?

hohoihiohi oioih oihio hioh fdoooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooosg

I am Web developer , but i don't understand something , i did search and asked many but they know it is just there but the don't give me a technical answer:

Main Question :

How SQL Injection works through URL with SQL in parameter ?

Description :

Assume i have database and in the database i have table named mytable and when i get id from method POST i put it in this query

SELECT * FROM `mytable` WHERE id='POST[id]'

Even if user put SQL like : SELECT * FROM mytable`

It became something like this: SELECT * FROM mytable WHERE id='SELECT * FROM mytable' So it just return :

You have an error in your SQL syntax

So i just think How these kind of attack works ?

How they change the query to pass Syntax Error ?