title: Learning sql inject
body: <p>Currently I a learning about SQL injection, I attempted </p>
  
  <pre><code>test ="'); DROP TABLE users; '";
  </code></pre>
  
  <p>It drings up the error message </p>
  
  <pre><code>mysql_num_rows() expects parameter 1 to be resource, boolean given in C:\Program Files (x86)\EasyPHP-DevServer-14.1VC9\data\localweb\my portable files\sqlinjection\login.php on line 18
  </code></pre>
  
  <p>Login code</p>
  
  <pre><code>session_start();
  
  $username = $_POST['username'];
  $password = $_POST['password'];
  $errors = array();
  
  
  if ($username&amp;&amp;$password)
  {
  
  $connect = mysql_connect("localhost","root","") or die ("Could not connect");
  mysql_select_db ("login") or die ("Could not find database");
  
  $query = mysql_query("SELECT * FROM users WHERE username ='$username'");
  
  $numrows = mysql_num_rows($query);
  if ($numrows !=0)
  {
      while ($row =mysql_fetch_assoc($query))
      {
          $dbusername = $row['username'];
          $dbpassword = $row['password'];
      }
  
      if ($username==$dbusername&amp;&amp;$password==$dbpassword)
      {
          echo header( 'Location: member.php' ) ;
          $_SESSION['username']=$dbusername;
      }
      else 
          echo "Incorrect password";
  
  }
  else
      die("That user dosen't exist");
  
  
  
  
  
  
  }
  
  else
      die("Please enter a username and a password");
  
  
  
  
  
  ?&gt;
  </code></pre>
  
  <p>Where am I going wrong or is this the expect result? I looked on my database and the table is there so I had guessed it was wrong. UPDATED to show login code.</p>