SQL injection does not work with mysqli

Question

I am creating a simple mocking website that demonstrates SQL injection. It looks like this:

The back end is written in PHP.

<?php
    $query = $_GET['query']; 

    $min_length = 3;

    if(strlen($query) >= $min_length){ 

        $raw_results = mysqli_query($con, "SELECT * FROM tools
            WHERE (`name` LIKE '%$query%')");

        if($raw_results === FALSE) { 
            echo "query failed, no results available." . mysqli_error($con);
            die();
        }

        if(mysqli_num_rows($raw_results) > 0){ // if one or more rows are returned do following

            while($results = mysqli_fetch_array($raw_results)){
                echo "<p><h3>".$results['name']."</h3>".$results['price']."</p>";
            }

        }
        else{ // if there is no matching rows do following
            echo "No results";
        }

    }
    else{ // if query length is less than minimum
        echo "Minimum length is ".$min_length;
    }
?>

For this following line of code:

$raw_results = mysqli_query($con, "SELECT * FROM tools
                WHERE (`name` LIKE '%$query%')");

If I modify the code into:

    $raw_results = mysqli_query($con, "SELECT * FROM tools
        WHERE (`name` LIKE '%')");//$query%')");

As long as I provide a string that is longer than or equal to three chars, the entire data base will be displayed, which means ')");// is a valid SQL injection attack.

But when I provide ')");// as a malicous input into the search box, I got this warning message:

query failed, no results available.You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '");//%')' at line N

I am not sure why my SQL injection would fail to retrieve any data.

Answer 1

You are trying to break out of the PHP function which is not how SQL injections work. An SQL injection is not a PHP code injection and double quotes won't let escape from the PHP string.

You can only modify the PHP string that contains the SQL statement:

"SELECT * FROM tools WHERE (`name` LIKE '%$query%')"

So instead, try something like x%' or '%' = '.