Deep understanding of where 1=1 is useful _mysql

Source: Internet
Author: User
Tags sql injection

What's the use of where 1=1? In the SQL language, writing such a sentence is not the same as writing.

The select * FROM table1 where 1=1 is completely indistinguishable from the select * from table1, and there are even many other written, 1<>2, ' a ' = ' a ', ' a ' <> ' B ', whose purpose is only one, where the condition is forever, the result is the unconstrained condition.

This is used in SQL injection, such as the SELECT * from table1 where name= ' lala ' to forcibly add a select * from table1 where name= ' lala ' or 1=1 this becomes an unconstrained query.

The recent discovery of the magic is that, in the indefinite number of query conditions, 1=1 can be very convenient specification statements. For example, a query may have name,age,height,weight constraints, or may not, how to deal with it?

String Sql=select * FROM table1 where 1=1

Why write an extra 1=1? I'll find out soon.

Copy Code code as follows:

if (!name.equals ("")) {
sql=sql+ "Name= '" "+name+" ";
}
if (!age.equals ("")) {
sql=sql+ "Age" "+age+" ";
}
if (!height.equals ("")) {
sql=sql+ "height= '" "+height+" ";
}
if (!weight.equals ("")) {
sql=sql+ "weight= '" "+weight+" ";
}

If you do not write 1=1, then in each of the query conditions that are not empty, must be judged there is no where sentence, or to be in the first place to add where

Where 1=1 is written in order to detect conditions in the process of checking
For example, there are three parameters a, B, c
@sql =select * from TB '
All three parameters may be empty
At this time you want to construct the statement, a test and then write a statement on the trouble
Like what
If @a is not null
@sql = @sql + "where a= ' + @a
If @b is not null
How do you write here? Do you want to add where or directly with and? You also need to detect if @a is empty

With the where 1=1, there is no such problem, provided that and is directly and, or is directly connected to or

Copy table
Create table_name AS SELECT * from source_table where 1=1;

Duplicate table structure
create   table_name   as   select   *    from   source_table   where   1 <> 1;

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.