title: My SQL injection doesn't seem to work?
body: <p>I have to do a project for school about a number of different web vulnerabilities (SQL, XSS, CSRF, etc), and I've made a very simple website to demonstrate the attacks on. But for some reason, I just cannot get SQL injection to work by attacking the login.</p>
  
  <p>Here is the simple login code:</p>
  
  <pre><code>$query = "SELECT * FROM customer WHERE cMAIL='$cmail' AND cPWD='$cpwd'";
  $res = mysql_query($query) or die(mysql_error());
  echo $query . mysql_error();
  $count = mysql_num_rows($res);
  
  if ($count == 1) {
      echo " Reached target!";
      session_start();
      $_SESSION["cmail"] = $cmail;
      $_SESSION["cpwd"] = $cpwd;
  } else {}
  </code></pre>
  
  <p>A lot of the echo stuff is so I can follow the injection to see what happens, but it gives me weird results.</p>
  
  <p>If I login as one of the customers; username: jjones@mit.edu, password = 123abc, it gives me the expected response:</p>
  
  <blockquote>
    <p>SELECT * FROM customer WHERE cMAIL='jjones@mit.edu' AND cPWD='123abc'
    Reached target!</p>
  </blockquote>
  
  <p>This is what it echos in the browser, just to be clear!</p>
  
  <p>And session is created for jjones. But if I do this: username: 1' OR '1'='1, password:(empty) it echoes this:</p>
  
  <blockquote>
    <p>SELECT * FROM customer WHERE cMAIL='1' OR '1'='1' AND cPWD=''</p>
  </blockquote>
  
  <p>No errors or anything. I've echo'd $count and it says 0 rows are selected from the database. So the injection is sound, but I'm not getting any rows based off the query. How do I solve this?</p>