封神平台 SQL-Labs

    $username = '';
    $password = '';
    @$id = $_GET['id'];
    @$sql = 'select *from user where id='.$id;
    mysqli_select_db($conn,'****');// 不想让你们知道库名
    $result = mysqli_query($conn,$sql);
    while ($row = mysqli_fetch_array($result)){  
    $username = $row['username'];
    $password = $row['password'];
    }
    echo 'Your Login name:'.$username;
    echo 'Your Password:'.$password;