I'm practicing SQL injection on DVWA (non-blind) with the lowest security settings. I want to list the tables in the current database. To do that, I attempt to enter 0'; show tables;-- in the User ID field like this

enter image description here

I expect that would issue the following statement to MySQL

SELECT * FROM users WHERE user_id = '0'; show tables;--'

However, when I hit submit I get this error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'show tables;--'' at line 1

I suspect its something simple I'm missing and would appreciate any help in learning the correct way to do this. Thanks!

  • 1
    The MySQL driver probably doesn’t allow sending multiple statements at once.
    – Gumbo
    Commented Feb 28, 2016 at 8:17

1 Answer 1


enter image description here

You can check the source below for the full scenario

Source : https://computersecuritystudent.com/SECURITY_TOOLS/DVWA/DVWAv107/lesson6/index.html

  • 2
    Link-only answers are strongly discouraged here. To improve your answer, you should include the relevant information in it.
    – tim
    Commented Feb 28, 2016 at 9:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .