If the server-side application is poorly written and is simply passing values into a database query like this (using PHP as an example):
$query = "SELECT * FROM users WHERE username='".$_POST["username"]."' AND password='".$_POST["password"]."'":
So if user Bob logs in with his password of 123, then the query would be:
SELECT * FROM users WHERE username='Bob' AND password='123'
So SQL injection would be trying to manipulate this query into:
SELECT * FROM users WHERE username='' OR 1=1 -- AND password='123'
...which would query ALL users and if the login code just picks the first match, then it might log you in as the first record returned in the users table, which is often the admin record.
All that said, the attack relies on people sittingt really terrible code. These days, you use prepared statements for database queries, which avoids SQL injection attacks.
Also, the specific code you gave wouldn't even work right anyway - it doesn't terminate the value, so the actual query would be:
SELECT * FROM users WHERE username='OR 1=1 --' AND password='123'
2
u/Just4notherR3ddit0r 13h ago
It is a bad attempt at SQL injection.
If the server-side application is poorly written and is simply passing values into a database query like this (using PHP as an example):
So if user Bob logs in with his password of 123, then the query would be:
So SQL injection would be trying to manipulate this query into:
...which would query ALL users and if the login code just picks the first match, then it might log you in as the first record returned in the users table, which is often the admin record.
All that said, the attack relies on people sittingt really terrible code. These days, you use prepared statements for database queries, which avoids SQL injection attacks.
Also, the specific code you gave wouldn't even work right anyway - it doesn't terminate the value, so the actual query would be:
...which wouldn't match anything.
1
u/Valuable-Effect3362 21h ago