I'm doing a CTF application for my final year project. I wanted to craft a SQL injection flag but I don't wish that they can simply found out the SQLi vulnerability by injecting ' . Hence, is there way to make SQL injection harder but not impossible using PHP?
Blind SQL injection is probably one of the harder techniques, in that it requires more work. You could make a page that doesn't display any output based on the query, but shows error messages when a query is malformed. The attacker would then be forced to use blind SQLi techniques to attack it.
Of course, an automated tool would break this immediately, since it could automate the entire injection. One interesting way around that would be to have some kind of super-simple image CAPTCHA (no distortion, just a plain image) that the attacker must solve in order to send a query. This would either force them to do it manually, or make them look into OCR techniques.
You could hide error details, which makes it harder for the user to know that injection is possible.
A next level would be Blind SQL injections, as Polynomial mentioned.
Also, you could reflect the injection on another page than the current page, for instance a log page so the user doesn't get imediate feedback on the injected code.
Or you could replace certain characters in the input string (See: SQL injection: isn't replace(“'”, “''”) good enough?).
My first thought is to limit what characters or regex patterns you look for. You could limit the use of only certain strings within the user input that would allow for attacks but would complicate what kind of attacks would work.
I'd say the easiest way to come up with something like this is probably to think of a particular attack you want someone to arrive at and then work backwards. Try to design protection to block everything other than the attack you wish them to perform. It could even be as simple as making it SQL Injection proof but then specifically allowing the desired attack input, though that might be a little too tricky depending on what you are looking for.