How can I ascertain and test SQL injection vunerabilities on this login code? I know about the "little bobby tables" scenario and was just wondering if this code is vulnerable to such SQL injections.

I am fairly new to PHP and am curious about this.

My code for a login script:

&lt;?php
  # session
  session_start();

  # get the variables from login.php
  $userid = $_POST["userid"];
  $pword = $_POST["pword"];

  mysql_real_escape_string($userid);
  mysql_real_escape_string($pword);

  # query the DB 
  $query = mysql_query ("
    SELECT username 
    FROM login 
    WHERE username = '$userid' 
    AND pword = '$pword';
  ");

  if ($query === FALSE) {
    die('There has been an error.&lt;br&gt;&lt;br&gt; Please re-enter your Login Details on the &lt;b&gt;&lt;a href="login.php"&gt;Login&lt;/a&gt;&lt;/b&gt; Page.&lt;br&gt;&lt;br&gt;');
  }

  $result = mysql_fetch_assoc($query);
  $record = $result['username'] ;

  # valid login
  # check if session is operational, if so redirect the user
  # to the correct page
  if ($record != null) {
    $_SESSION['login'] = true;
    header( 'Location: index.php' ) ;
  }

  # invalid login
  else if ($record == null) {
    echo "
    We cant find you on the system.
    &lt;br/&gt;
    Please return to the &lt;b&gt;&lt;a href='login.php'&gt;Login&lt;/a&gt;&lt;/b&gt; page and ensure that 
    &lt;br/&gt;
    you have entered your details correctly.
    &lt;br&gt;&lt;br&gt;
    &lt;b&gt;Warning&lt;/b&gt;: You willl be redirected  back to the Login Page 
    &lt;br&gt; in &lt;b&gt; &lt;span id='counter'&gt;10&lt;/span&gt; Second(s)&lt;/b&gt;";
  }
?&gt;


The main reason for asking this is that when I login inputting:

'user'); DROP TABLE Login;--'


it doesn’t drop the table.


My question is: Am I typing in the right SQL injection?
This is vulnerable:

mysql_real_escape_string($userid);
mysql_real_escape_string($pword);


does not return the variable. Use:

$userid = mysql_real_escape_string($userid);
$pword = mysql_real_escape_string($pword);


If you really want to take care of all vulnerable SQL injections try to move to PDO. Here is a nice tutorial