I'm practicing SQL injection on DVWA (non-blind) with the lowest security settings. I want to list the tables in the current database. To do that, I attempt to enter 0'; show tables;-- in the User ID field like this

enter image description here

I expect that would issue the following statement to MySQL

SELECT * FROM users WHERE user_id = '0'; show tables;--'

However, when I hit submit I get this error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'show tables;--'' at line 1

I suspect its something simple I'm missing and would appreciate any help in learning the correct way to do this. Thanks!

  • 1
    The MySQL driver probably doesn’t allow sending multiple statements at once.
    – Gumbo
    Feb 28 '16 at 8:17

enter image description here

You can check the source below for the full scenario

Source : https://computersecuritystudent.com/SECURITY_TOOLS/DVWA/DVWAv107/lesson6/index.html

  • 2
    Link-only answers are strongly discouraged here. To improve your answer, you should include the relevant information in it.
    – tim
    Feb 28 '16 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.