How can I ascertain and test SQL injection vunerabilities on this login code?

Question

I know about the "little bobby tables" scenario and was just wondering if this code is vulnerable to such SQL injections.

^{I am fairly new to PHP and am curious about this.}

My code for a login script:

<?php
 # session
 session_start();
 # get the variables from login.php
 $userid = $_POST["userid"];
 $pword = $_POST["pword"];
 mysql_real_escape_string($userid);
 mysql_real_escape_string($pword);
 # query the DB 
 $query = mysql_query ("
 SELECT username 
 FROM login 
 WHERE username = '$userid' 
 AND pword = '$pword';
 ");
 if ($query === FALSE) {
 die('There has been an error.<br><br> Please re-enter your Login Details on the <b><a href="login.php">Login</a></b> Page.<br><br>');
 }
 $result = mysql_fetch_assoc($query);
 $record = $result['username'] ;
 # valid login
 # check if session is operational, if so redirect the user
 # to the correct page
 if ($record != null) {
 $_SESSION['login'] = true;
 header( 'Location: index.php' ) ;
 }
 # invalid login
 else if ($record == null) {
 echo "
 We cant find you on the system.
 <br/>
 Please return to the <b><a href='login.php'>Login</a></b> page and ensure that 
 <br/>
 you have entered your details correctly.
 <br><br>
 <b>Warning</b>: You willl be redirected back to the Login Page 
 <br> in <b> <span id='counter'>10</span> Second(s)</b>";
 }
?>

The main reason for asking this is that when I login inputting:

'user'); DROP TABLE Login;--'

it doesn’t drop the table.

My question is: Am I typing in the right SQL injection?

• user1662306: the single quotes around the sql are not used, theyre only there for the purpose of this question

Answer 1

This is vulnerable:

mysql_real_escape_string($userid);
mysql_real_escape_string($pword);

does not return the variable. Use:

$userid = mysql_real_escape_string($userid);
$pword = mysql_real_escape_string($pword);

If you really want to take care of all vulnerable SQL injections try to move to PDO. Here is a nice tutorial

• slugonamission: Oops, I didn't notice this in my answer. To add to this one though, you are not dropping the table because the mysql_* family of functions only execute a single statement, not multiple ones, so anything after the ; in your statement (e.g. the DROP TABLE) is ignored.
• EaterOfCorpses: @slugonamission so I was not wrong
• Mihai Iorga: yes, but to get to last ; it will have to pass $userid and $pword right?
• slugonamission: @EaterOfCorpses - I never said you were?
• EaterOfCorpses: @slugonamission See my answer I posted just at the same time as you lol

Answer 2

The injection doesn't work because mysql_query only does the first query till the ; then it stops so its not possible that way, correct me if I'm wrong.

• bdsl: That's right, but the code is vulnerable to to other SQL injection attacks.