i was trying to check a web site for an sql injection attack and amazed to see it not very very simple to prevent because below is the simple code .
$sql="select * from user_acount where login_id='".$username."' and password='".$password."' and status='1' ";
i can not do any sql injection to test it. i wrote the following
1st Attempt to check sql injection
Login: admin'--
Password:'i typed nothing here '
Result Wrong password you cannot login.
2nd:
Login: admin or 1=1 --'
Password:''
Result Wrong password you cannot login.
3rd:
Login: admin' or 1=1
Password:''
4th: Login: admin or 1=1'-- Password:''
Result Wrong password you cannot login.
Can anyone please explain what is stopping me ? i am not using prepared statements nor i am using any filter class neither i have real_escape_string ?