I know about the "little bobby tables" scenario and was just wondering if this code is vulnerable to such SQL injections.

I am fairly new to PHP and am curious about this.

My code for a login script:

  # session

  # get the variables from login.php
  $userid = $_POST["userid"];
  $pword = $_POST["pword"];


  # query the DB 
  $query = mysql_query ("
    SELECT username 
    FROM login 
    WHERE username = '$userid' 
    AND pword = '$pword';

  if ($query === FALSE) {
    die('There has been an error.<br><br> Please re-enter your Login Details on the <b><a href="login.php">Login</a></b> Page.<br><br>');

  $result = mysql_fetch_assoc($query);
  $record = $result['username'] ;

  # valid login
  # check if session is operational, if so redirect the user
  # to the correct page
  if ($record != null) {
    $_SESSION['login'] = true;
    header( 'Location: index.php' ) ;

  # invalid login
  else if ($record == null) {
    echo "
    We cant find you on the system.
    Please return to the <b><a href='login.php'>Login</a></b> page and ensure that 
    you have entered your details correctly.
    <b>Warning</b>: You willl be redirected  back to the Login Page 
    <br> in <b> <span id='counter'>10</span> Second(s)</b>";

The main reason for asking this is that when I login inputting:

'user'); DROP TABLE Login;--'

it doesn’t drop the table.

My question is: Am I typing in the right SQL injection?

  • \$\begingroup\$ the single quotes around the sql are not used, theyre only there for the purpose of this question \$\endgroup\$
    – user1662306
    Oct 2, 2012 at 9:55

2 Answers 2


This is vulnerable:


does not return the variable. Use:

$userid = mysql_real_escape_string($userid);
$pword = mysql_real_escape_string($pword);

If you really want to take care of all vulnerable SQL injections try to move to PDO. Here is a nice tutorial

  • 1
    \$\begingroup\$ Oops, I didn't notice this in my answer. To add to this one though, you are not dropping the table because the mysql_* family of functions only execute a single statement, not multiple ones, so anything after the ; in your statement (e.g. the DROP TABLE) is ignored. \$\endgroup\$
    – slugonamission
    Oct 2, 2012 at 9:58
  • \$\begingroup\$ @slugonamission so I was not wrong \$\endgroup\$
    – EaterOfCorpses
    Oct 2, 2012 at 10:02
  • \$\begingroup\$ yes, but to get to last ; it will have to pass $userid and $pword right? \$\endgroup\$
    – Mihai Iorga
    Oct 2, 2012 at 10:04
  • \$\begingroup\$ @EaterOfCorpses - I never said you were? \$\endgroup\$
    – slugonamission
    Oct 2, 2012 at 10:04
  • \$\begingroup\$ @slugonamission See my answer I posted just at the same time as you lol \$\endgroup\$
    – EaterOfCorpses
    Oct 2, 2012 at 10:05

The injection doesn't work because mysql_query only does the first query till the ; then it stops so its not possible that way, correct me if I'm wrong.

  • \$\begingroup\$ That's right, but the code is vulnerable to to other SQL injection attacks. \$\endgroup\$
    – bdsl
    Feb 22, 2015 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.