diff --git a/vulnerabilities/sqli_blind/source/high.php b/vulnerabilities/sqli_blind/source/high.php
new file mode 100644
index 0000000..466e4df
--- /dev/null
+++ b/vulnerabilities/sqli_blind/source/high.php
@@ -0,0 +1,53 @@
+<?php
+
+if( isset( $_SESSION [ 'id' ] ) ) {
+	// Get input
+	$id = $_SESSION[ 'id' ];
+
+	switch ($_DVWA['SQLI_DB']) {
+		case MYSQL:
+			// Check database
+			$query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;";
+			$result = mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '<pre>Something went wrong.</pre>' );
+
+			// Get results
+			while( $row = mysqli_fetch_assoc( $result ) ) {
+				// Get values
+				$first = $row["first_name"];
+				$last  = $row["last_name"];
+
+				// Feedback for end user
+				$html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
+			}
+
+			((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);		
+			break;
+		case SQLITE:
+			global $sqlite_db_connection;
+
+			$query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;";
+			#print $query;
+			try {
+				$results = $sqlite_db_connection->query($query);
+			} catch (Exception $e) {
+				echo 'Caught exception: ' . $e->getMessage();
+				exit();
+			}
+
+			if ($results) {
+				while ($row = $results->fetchArray()) {
+					// Get values
+					$first = $row["first_name"];
+					$last  = $row["last_name"];
+
+					// Feedback for end user
+					$html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
+				}
+			} else {
+				echo "Error in fetch ".$sqlite_db->lastErrorMsg();
+			}
+			break;
+	}
+}
+
+?>
diff --git a/vulnerabilities/sqli_blind/source/high_sqli_blind.php b/vulnerabilities/sqli_blind/source/high_sqli_blind.php
new file mode 100644
index 0000000..576ecae
--- /dev/null
+++ b/vulnerabilities/sqli_blind/source/high_sqli_blind.php
@@ -0,0 +1,63 @@
+<?php
+
+if( isset( $_COOKIE[ 'id' ] ) ) {
+	// Get input
+	$id = $_COOKIE[ 'id' ];
+	$exists = false;
+
+	switch ($_DVWA['SQLI_DB']) {
+		case MYSQL:
+			// Check database
+			$query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;";
+			try {
+				$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ); // Removed 'or die' to suppress mysql errors
+			} catch (Exception $e) {
+				$result = false;
+			}
+
+			$exists = false;
+			if ($result !== false) {
+				// Get results
+				try {
+					$exists = (mysqli_num_rows( $result ) > 0); // The '@' character suppresses errors
+				} catch(Exception $e) {
+					$exists = false;
+				}
+			}
+
+			((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
+			break;
+		case SQLITE:
+			global $sqlite_db_connection;
+
+			$query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;";
+			try {
+				$results = $sqlite_db_connection->query($query);
+				$row = $results->fetchArray();
+				$exists = $row !== false;
+			} catch(Exception $e) {
+				$exists = false;
+			}
+
+			break;
+	}
+
+	if ($exists) {
+		// Feedback for end user
+		$html .= '<pre>User ID exists in the database.</pre>';
+	}
+	else {
+		// Might sleep a random amount
+		if( rand( 0, 5 ) == 3 ) {
+			sleep( rand( 2, 4 ) );
+		}
+
+		// User wasn't found, so the page wasn't!
+		header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' );
+
+		// Feedback for end user
+		$html .= '<pre>User ID is MISSING from the database.</pre>';
+	}
+}
+
+?>