When you have code like this:

mysql_query("select a from b where b.username='$x' and b.password='$y'")

And you enter Admin' " );-- then you'll get:

mysql_query("select a from b where b.username='Admin' \" );--' and b.password='whatever'")

and that's invalid syntax for a SQL query. You're just able to insert SQL code, not PHP code.

When you have code like this:

mysql_query("select a from b where b.username='$x' and b.password='$y'")

And you enter Admin' " );-- then you'll get:

mysql_query("select a from b where b.username='Admin' \" );--' and b.password='whatever'")

and that's invalid syntax for a SQL query. You're just able to insert SQL code, not PHP code.

Is the username case sensitive and is the user name literally "Admin"?

Is the username case sensitive and is the user name literally "Admin"?

khr0x40sh wrote:
Is the username case sensitive and is the user name literally "Admin"?

Well part of the challenge is figuring that out, but yeah, you should assume that.

And just FYI, the SQL injection challenges were not working properly due to updates. They should be fixed now.

khr0x40sh wrote:
Is the username case sensitive and is the user name literally "Admin"?

Well part of the challenge is figuring that out, but yeah, you should assume that.

And just FYI, the SQL injection challenges were not working properly due to updates. They should be fixed now.

ynori7 wrote:
And just FYI, the SQL injection challenges were not working properly due to updates. They should be fixed now.

This makes me so mad, lol, glad it is working now.

ynori7 wrote:
And just FYI, the SQL injection challenges were not working properly due to updates. They should be fixed now.

This makes me so mad, lol, glad it is working now.