SQL injection principle--Universal Password injection

The principle of "universal password"
When a user authenticates a user name and password, the Web site needs to query the database. Querying the database is the execution of the SQL statement. For this BBS forum, when the user logs on, the database query operation (SQL statement) executed in the background is "Selectuser id,user type,email from users Where user id= ' username ' and password= ' password '"
Because the site background in the database query does not filter the single quotation marks, when the user name "admin" and the Universal password "2 ' or ' 1", the execution of the SQL statement is "Select User Id,user Type,email from users Whereuser id= ' admin ' and password= ' 2 ' Or1 ". Also, because the logical operators in the SQL statement have precedence, "=" takes precedence over "and", "and" takes precedence over "or" and is applicable for transitivity. Therefore, when this SQL statement is parsed in the background, it is divided into two sentences "Select User Id,user type,emall from users Where user id= ' admin andpassword= ' 2 '" and "' 1 '" two bool values for logical O n operation, Constant is true. The query result of the SQL statement is true, which means that authentication is successful and can be logged into the system.

Www.hanbotec.com

SQL injection principle--Universal Password injection