Can anyone provide me with a piece of code that could be used for a sql injection please? Something that would create a new MySQL table if it worked. Sounds like a weird thing to ask for I know, but I'm trying to test the security of a script, and I don't know how to test this bit.
it partly depends on how your sql is structured and other security measures in place. Mod_security does can do some great filtering that can protect against sql injection. http://www.georgehubka.com/2008/04/20/where-to-get-mod_security-rules/
mybe I can help. But my english not enought. you can chance database table, For example Admin Security : a_admin you can control code after that block some injection attack for example. union,select,from,-1,1 etc..