Hi I'm doing a project on computer forensics which I'm suppose to create scenarios for people to "hack".
I just created a lottery website for my first scenario which will generate 7 random sets of non-repeating numbers ranging from 1 to 45.

My program procedure:

-create an account at the home page.

-Click on the generate button to generate 7 digit codes.

-one user is only allow to generate one time.

-once generated, the 7 digits will be pushed into the SQL as a record.

here is the problem, how can i change database information? as the hacker, i want to change the database information of my 7 digit codes to match with the lottery results to win.

Solutions i have tried is firebug, which didn't work because it only changes data from client side and not server, can't change database information.
i learn about SQL injection, like enter a' or 't' ='t for user and password would log in as the first account of the database, but i still have no idea how to change the lottery number in the database after generating.

I have done the entire website already, which is working but now I got to hack myself. which I acquire your help to change database information

Hopefully anyone here can help me out! thanks in advanced!

You would have to run a few queries (presumably) to find out the names of the fields, then you would run an injection like...
' or 1=1; UPDATE tablename SET num1=10,num2=10,...,num7=10 where someIdentifyingField=someIdentifyingInfo --
This would (theoretically) let the first query succeed, then run the updating query... of course the field names would need replaced, etc

If you need more info/help, let me know @ aksnowman@hack3r.com