[fierce]

when i typed this code on the comment box on my school site "http://www.catanduanesstatecolleges.edu.ph/feedback/"

<?php
/*
Un-Stripped PHP
*/

$var = $_GET['var'];

echo $var;
//Vulnerable

$var1 = $_POST['var1'];

echo $var1;
//Vulnerable

echo $_SERVER['HTTP_USER_AGENT'];
//Vulnerable

?>


the page loaded an gives me this error:

An error occurred: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'var\'']; echo $var; //Vulnerable $var1 = $_POST[\''var1\'']; echo $var' at line 4


what will i do now? i already found the vulnerability of the field.

[ChuckNorrisLove]

you can't use ' symbol, change it with ", or it will give you sql syntax error.
test it with <?php echo "123"; ?>
if it works, then u shud be able to upload some evil codes.