jjacquay712 Posted September 10, 2008 Share Posted September 10, 2008 I know basic sql injection, but am confused on one statement: OR 1 = 1. wouldn't this just return a row(1) from the table where the column is equal to '1'? Im confused on how this work and need to protect my scripts from this kind of attack. Link to comment https://forums.phpfreaks.com/topic/123601-solved-sql-injection-help/ Share on other sites More sharing options...
BlueSkyIS Posted September 10, 2008 Share Posted September 10, 2008 that is a condition. it says "do this if 1 = 1". 1 = 1, i'm pretty sure. Link to comment https://forums.phpfreaks.com/topic/123601-solved-sql-injection-help/#findComment-638296 Share on other sites More sharing options...
ready4god2513 Posted September 10, 2008 Share Posted September 10, 2008 say that you are having a user log in. If you said SELECT usersname, password FROM users WHERE username = $POST_['whatever'] Well, if the user enters in- myname 'OR 1 =1' your query will return all of the users in your database. Why? Because 1 is equal to 1. At that point it isn't looking for anything to match in the database, just a true condition, which is was given. Now that the true condition is found, it doesn't filter out any specific results, but will return them all. This can be a problem, obviously. Link to comment https://forums.phpfreaks.com/topic/123601-solved-sql-injection-help/#findComment-638585 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.