[Reynolds]

I am trying to perform an SQL injection using this plugin on my own server (solely for pentest purposes) and I have a question. I have a command whose input is deliberately unescaped and I am trying to delete a table abusing this mistake. The code is:

Код:

CMD:testtest( playerid, params[] )
{
	TestT( "asd", params );
	return 1;
}

TestT(nme[], tst[])
{
	format(query, sizeof(query), "INSERT INTO `test` (`asdfg`, `fghij`) VALUES ('%s', '%s')", nme, tst);
	mysql_query(query);
	return 1;
}

Using deliberately malicious input such as:

Код:

/testtest fgh'); DROP TABLE `example`;--

yields the following error:

Код:

[23:44:38] CMySQLHandler::Query(INSERT INTO `test` (`asdfg`, `fghij`) VALUES ('asd', 'fgh'); DROP TABLE `example`;-- ')) - An error has occured. (Error ID: 1064, You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DROP TABLE malibusux;-- ')' at line 1)

The following code runs perfectly fine on phpMyAdmin. Is there a reason why these attacks do not work, or am I doing something wrong?