I’m here for something a little bit spécial.
I have this challenge: break this code with SQL injection

function checkLog($login, pswrd, $conn)

  {

  if(!empty($login) && !empty($pswrd))

    {

    $result=mysqli_query($conn, "SELECT * FROM utilisateurs LEFT JOIN classes ON utilisateurs.classes_id=classes.id WHERE login_utilisateur='".addslashes($login)."' AND password_utilisateur_md5='".addslashes($pswrd)."'");

    $enr=mysqli_fetch_object($result);

      if(($enr->id_classes??"")==1 && $_SERVER['HTTP_HOST']!=($enr->url_classes??"")) {return false;}

      elseif(mysqli_num_rows($result)>0) {return true;}

      }

  }

I know it’s terrible way to handle login on a website:

• using md5 on passwords is a bad idea
• there is no prepare on the query to avoir SQL injection and addslashes is not a way to avoid it.

I don’t have access to the full request. Below the not troncated version.

    $result=mysqli_query($conn, "SELECT * FROM utilisateurs LEFT JOIN classes ON utilisateurs.id_classes=classes.id WHERE login_utilisateur='".addslashes($login)."' AND password_utilisateur_md5='".addslashes($pswrd)."' AND date_sort

Si I’m trying to perform an SQL injection.

I’v tried:

• some classics SQL injection, with commentarys –: it doesn’t work, the addslashes do the job.
• i’v seen some techniques using special characters but nothing seems to work. Is it linked to the charset ?

Thanks for your help !
Sorry for my non perfect english !