How to do SQL injection on MY server?

Question

SQL

I decided to learn how to protect myself from SQL injections.
I immediately tried to test it on my server. There is a query that gets a user from the database by his id:

SELECT * FROM `users` WHERE `id` = '{$_POST['id']}'

. If you substitute id 1, you get . How can you perform a SQL injection by getting a user with id 2 as well? SELECT * FROM `users` WHERE `id` = '1'

Answer 1

if id is equal to "1' or `id`='2" then you will get
SELECT * FROM `users` WHERE `id` = '1' or `id`='2'