title: SQL Injection Username and Password
body: <p>I've been working on a project with a few friends. Our assignment was to find the Username and Password credentials to log in to a fake database</p>
  
  <p>Here is the source code:</p>
  
  <pre><code>&lt;?php
  include "config.php";
  $con = mysqli_connect("localhost", "sql1", "sql1", "sql1");
  $username = $_POST["username"];
  $password = $_POST["password"];
  $debug = $_POST["debug"];
  $query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
  $result = mysqli_query($con, $query);
  
  if (intval($debug)) {
    echo "&lt;pre&gt;";
    echo "username: ", htmlspecialchars($username), "\n";
    echo "password: ", htmlspecialchars($password), "\n";
    echo "SQL query: ", htmlspecialchars($query), "\n";
   if (mysqli_errno($con) !== 0) {
   echo "SQL error: ", htmlspecialchars(mysqli_error($con)), "\n";
    }
    echo "&lt;/pre&gt;";
  }
  
  if (mysqli_num_rows($result) !== 1) {
    echo "&lt;h1&gt;Login failed.&lt;/h1&gt;";
  } else {
    echo "&lt;h1&gt;Logged in!&lt;/h1&gt;";
    echo "&lt;p&gt;Your flag is: $FLAG&lt;/p&gt;";
  }
  
  ?&gt;
  </code></pre>
  
  <p>The proctor gave us a hint asking "What happens if username or password contains a single quote <code>'</code>?</p>
  
  <p>I have tried everything from <code>' or 1=1--</code></p>
  
  <p>to things like <code>' OR a=1--</code></p>
  
  <p>if anyone could help I would greatly appreciate it!</p>