title: Testing SQL injection / Drop table not working
body: <p>I am trying to test SQL injection against my site by trying to drop a table(user) and its not working.</p>
  
  <p>my sql string syntax:</p>
  
  <pre><code>String sql = "select * from users where username='" + username + "' and password='" + password + "';";
  </code></pre>
  
  <p>I put <code>jack</code> in the username field and
  <code>test'; DROP TABLE users; --</code> in the password field and get the following sql string: </p>
  
  <p><code>select * from users where username='jack' and password='test'; DROP TABLE users; --';</code>
   and then I execute it:</p>
  
  <pre><code>Statement st = conn.createStatement();
  ResultSet rs = st.executeQuery(sql);
  </code></pre>
  
  <p>But its not working, Any idea why?</p>