I am trying to learn about PHP and SQL Injections, so I have created a login form where users introduce their username and password and click the Login button. Later in the server I get the passed parameters using $_POST global variable.
This is the code used to check if user credentials are valid:
$email = $_POST['u_email']; $password = $_POST['u_password']; $query = "SELECT * FROM User WHERE EMAIL='$email' AND PASSWORD='$password'"; $result = $mysqli->query($query); $counter = mysqli_num_rows($result); if($counter == 1)//Correct Login
The problem is that I think that if a user enters the following text in the username and password fields, the login should be done (although they are not valid values because they do not exist in the DB).
Username: xxx' OR '1'='1/* Password: */
I think so because that would be translated to:
$query = "SELECT * FROM User WHERE EMAIL='xxx' OR '1'='1/*' AND PASSWORD='*/'";
In other words:
$query = "SELECT * FROM User WHERE EMAIL='xxx' OR '1'='1'";
But the SQL Injection is not working, why?
My DBMS is MySQL.