first commit

dvwa/vulnerabilities/sqli_blind/source/low.php

@@ -0,0 +1,28 @@
+<?php
+
+if( isset( $_GET[ 'Submit' ] ) ) {
+	// Get input
+	$id = $_GET[ 'id' ];
+
+	// Check database
+	$getid  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
+	$result = mysql_query( $getid ); // Removed 'or die' to suppress mysql errors
+
+	// Get results
+	$num = @mysql_numrows( $result ); // The '@' character suppresses errors
+	if( $num > 0 ) {
+		// Feedback for end user
+		$html .= '<pre>User ID exists in the database.</pre>';
+	}
+	else {
+		// User wasn't found, so the page wasn't!
+		header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' );
+
+		// Feedback for end user
+		$html .= '<pre>User ID is MISSING from the database.</pre>';
+	}
+
+	mysql_close();
+}
+
+?>