Test SQL Injection String. In real-world applications, it may be hard to check whether your SQL injec- tion attack contains any syntax error, because usually servers do not return this kind of error messages. To conduct your investigation, you can copy the SQL statement from php source code to the MySQL console. Assume you have the following SQL statement, and the injection string is or 1=1;#. SELECT * from credential WHERE name=$name and password=$pwd; You can replace the value of $name with the injection string and test it using the MySQL console. This approach can help you to construct a syntax-error free injection string before launching the real injection attack.