I wonder how SQL injection works through URL with SQL in the parameter. Assume I have a database with a table named mytable. When I get an ID from method POST I put it in this query:

SELECT * FROM `mytable` WHERE id='POST[id]'

Even if the user puts SQL like:

SELECT * FROM 'mytable'

It became something like this:

SELECT * FROM `mytable` WHERE id='SELECT * FROM 'mytable'

So it just returns:

You have an error in your SQL syntax.

So how does this kind of attack work? How can the attacker change the query without causing a syntax error?