title: Demonstrating SQL injection attacks to my boss
body: <p>So I have a project with work to try and teach my boss to start using prepared SQL statements, but he could care less and says it's not a big deal. I want to know how to prove to him it is a big deal, but I just can't figure out how to inject a drop table command on the development test server we have set up. I developed an application for a company that is in its testing phase and I want to take it down (have back up) to present to him the issue, as I am using his SQL code. I am trying to get the company to get in habit of using prepared statements, but I seem to be the only one wanting change and they don't. Can someone help me "crack" this database with SQL injection? Thanks!!</p>
  
  <p>There is a comment box on the form to be submitted and when it sees an apostrophe it throws the error: </p>
  
  <p>Unable to Make Query:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's";', '100', '100')' at line 78</p>
  
  <p>I've tried</p>
  
  <pre><code>foo'); DROP TABLE cabletypes;--
  </code></pre>
  
  <p>but gives same error. How can I make it inject successfully when I am typing in the textarea prior to form submission? The textarea submits to the 'comments' column and value.</p>
  
  <p>SQL</p>
  
  <pre><code>$sql="INSERT INTO cabletypes
          (cable_type,
          sample_no,
          sample_date,
          section_lg,
          wet_dry,
          avgofppf,
          sheath_type,
          plastic_wt,
          inner_sheath,
          inner_al_wt,
          inner_steel_wt,
          cable_guard,
          guard_al_wt,
          guard_steel_wt,
          guard_other_wt,
          total_pairs_a,
          pair_count_gauge_a,
          copper_wt_a,
          total_pairs_b,
          pair_count_gauge_b,
          copper_wt_b,
          total_pairs_c,
          pair_count_gauge_c,
          copper_wt_c,
          total_pairs_d,
          pair_count_gauge_d,
          copper_wt_d,
          sum_pairs,
          copper_wt,
          copper_percent,
          lead_wt,
          lead_percent,
          contains_lead,
          waste_wt,
          sampler,
          supervisor,
          comments,
          cable_no,
          section_no)
          VALUES (
          '$cable_type',
          '$sample_no',
          '$sample_date',
          '$section_lg',
          '$wet_dry',
          '$avgofppf',
          '$sheath_type',
          '$plastic_wt',
          '$inner_sheath',
          '$inner_al_wt',
          '$inner_steel_wt',
          '$cable_guard',
          '$guard_al_wt',
          '$guard_steel_wt',
          '$guard_other_wt',
          '$total_pairs_a',
          '$pair_count_gauge_a',
          '$copper_wt_a',
          '$total_pairs_b',
          '$pair_count_gauge_b',
          '$copper_wt_b',
          '$total_pairs_c',
          '$pair_count_gauge_c',
          '$copper_wt_c',
          '$total_pairs_d',
          '$pair_count_gauge_d',
          '$copper_wt_d',
          '$sum_pairs',
          '$copper_wt',
          '$copper_percent',
          '$lead_wt',
          '$lead_percent',
           0,
          '$waste_wt',
          '$sampler',
          '$supervisor',
          '$comments',
          '$cable_no',
          '$section_no')";
      }
  
  mysql_query($sql) or die ("Unable to Make Query:" . mysql_error());
  
  print("Sample Sheet Submitted Successfully!");
  </code></pre>