Add SQL injection attacks to programs

SQL injection attacks are generally used by hackers to attack other users' websites or programs. But now we can switch our minds and use SQL injection to serve us.

For example, there is an old program that uses simple Layer 3. The table name operated by this program is Table1, And the Table1 fields include:
Id (int), column1 (nvarchar (50), column2 (nvarchar (50), adddate (smalldatetime ).

Here, the adddate field is appended, that is, some data elements have values for the adddate field, some are null, and the value of the adddate field is not used in the original program, adddate is required to determine different years, and empty values are divided into old data (for example, null and 2013 both belong to data of, and data of belongs to data ), you cannot change the data in the database.

Suppose we can write a method in the DAL and BLL layers to pass in only the year (for example, pass in 2013, and the parameter is named year) and call it in the Web layer. To write programs using the SQL injection method, we do not make too many logical judgments on the passed year, just put year into a pre-written SQL statement for execution (assuming that our SQL query statement is very simple, for example: string SQL = "select * from Table1 where adddate> = '" + year + "/1/1' and adddate <= '" + year + "/12/31 '";),

In this case, the data obtained in January 2013 does not contain data elements whose time is null. In this case, we can use SQL injection to set the year value to "'or adddate is null and 1 = '1 ';--", the data found after execution is the sum of 2013 and null.

The above is just a simple reverse idea I want: Put the things originally used for hacking into a program for the correct purpose. To put it deeper, it means that the originally harmful things are not necessarily completely harmful (that is, just put the wrong place). Using them in the right place will achieve good results.

I am a newbie. Do not spray.