I have a table with lots of user info - email, password and others. The server performs this query without using prepared statements:
SELECT * FROM login where email = '$_POST';
I want to do an SQL injection with the post variable to get the password column named as first_name
in order for it to be printed in the page HTML. first_name
is also a column name in the table.
I tried this but it won't work:
SELECT * FROM login where email = '1' or '1' = '1' union select null, first_name, null as col, null as col, null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col from login;
Any ideas on how to achieve this?