Basic 16

Okay I already beat this lvl…easy…BUT my question is how do I know that its sql vulnerable except being told, in fact how do I know it's PHP in the first place? It make it easier to find vulnerabilities if I could limit them down a little….

Well, files ending in ".php" are always php files, and sometimes other extensions aswell. There is no real way to "check", other than trying it for yourself. There are some applications out there that automate the Injection process, but whether or not you use those depends on your stance of applications like that. SQLMap and Nikto are tools commonly used to search for injections of all sorts.

SQL injection isn't just limited to PHP files, by the way. Anything that queries a database has a chance of being injected.

MoshBat wrote: (Is it just me, or has it suddenly gotten really active? I mean active for this place…)

Yeah, it's picked up quite a bit lately. Also, I beat you to this one, too ;)