mysql - PHP 5.4 SQL Injection -

I'm trying to create a simple php page that shows SQL injection.

  & lt ;? Php ... if ($ _POST) {$ user = $ _POST ['user']; If ($ result = $ db-> query ("Select * user WHERE user name = '". $ User. "'") ")) {// display result array} else {// invalid query}} ...? & Gt;  In the html input, the injected code is  whatever "or 1 = 1; drop table user; -  but it always triggers invalid query blogs   
 How do I run a script to validate this SQL?   
 
 
 
 How do I validate the script in thinking about this SQL?   
 You can not invoice it in  thinking  This is a valid SQL. It is a valid SQL.  
 It can help when resonanting the resulting SQL statement to see the actual result:  
  $ stmt = "Select * from users where user name = ''. $ User ""; $ Stmt echo; If ($ result = $ db-> query ($ stmt)) {// â ?? |}   
 Since the injection is in one, you provide pieces of SQL that allow you to avoid that string. Since the string is literally enclosed in single quotation marks, the single single quote indicates the end delimiter and there is no following data R: string is interpreted as:  
  User: whatever The result will be as follows:  
  Select Username = 'Whatever' or '1' = '1' # \ _________________ / # Injection   
 Note that this is the only reason why a single statement executes B second statement causes an error, the other  drop table  statement examples work here.