关于MySql的语句漏洞谁知谁晓~~~~

各位大虾小弟我正在写一个带漏洞的PHP网页，代码：
$sql = "select * from user where name = '$name' and pwd = '$pwd'";
$result = mysql_db_query($dbname,$sql,$conn);
$userinfo = mysql_fetch_array($result);
if(empty($userinfo))
{
        echo "error";
}
else
{
        echo "ok";
}

从代码来看，查询应该是有问题的，只要输入：'or''='应该能正确提交输出OK，为什么我的不行呢？？？

这样试试

$sql = "select * from user where name = '$name' and pwd = '$pwd'";
$result = mysql_query($sql,$conn);
$userinfo = mysql_fetch_array($result);
if(empty($userinfo))
{
        echo "error";
}
else
{
        echo "ok";
}