title: How do I prove my input is SQL injection safe? I need an example of sql injection to fail on my site
body: <p>I'm writing my final thesis and I need image illustration that one of my web input fields is sql injection safe! I have a php backend and a my sql database. I have used prepared statements for my queries so they should be safe right? However I need some screen dumbs of me trying to "hack" my input field to prove that it works. I'm not a hacker so I don't know any working examples. I know that I have to break the sql syntax somehow and then write some sql query that eventually would be run. I would like some really simple example, eventually truncate table or something like that, how can I illustrate this?</p>
  
  <p><a href="https://i.stack.imgur.com/X45YW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/X45YW.png" alt="enter image description here"></a></p>
  
  <p><strong>php Code that should be injection safe right? (please confirm ;)</strong></p>
  
  <pre><code>if($action == 'layout'){
  $pos = 1;
  foreach($_POST as $key =&gt; $value) {
      if (strstr($key, 'se')){
          $values = [];
          foreach($value as $se) {
              $values[] = $se;
          }
  
          $stmt = $mysqli_link-&gt;prepare("REPLACE INTO tblSvgElement(PlaceID, SVG, SVGPosition, Path1Color, Path2Color, Path3Color) VALUES (?,?,?,?,?,?)");
          $stmt-&gt;bind_param("iissss", $zite_id, $values[0], $pos, $values[1], $values[2], $values[3]);
          $stmt-&gt;execute();
          $pos +=1;
      }
  }
  $stmt-&gt;close();
  $mysqli_link-&gt;close();
  </code></pre>
  
  <p>}</p>