In SQL Injection java, add the MySQL database verification secret & #39; or & #39; 1 & #39 ;=& #39; 1, you can see the universal password, mysql universal password

SQL Injection: add 'or '1' = '1' to the MySQL database Authentication secret in java.

Add 'or '1' =' 1 to the password string to create a universal password.

The reason is as follows:

In the original code, the password is 123456.

Execute database query statements

The SQL statement actually executed is:

Select * from sw_user where username = 'SWIFT 'and password = '000000'

This requires that the account and password are correct before logon is successful.

If someone sets a password like this, it becomes a universal password. All user names and passwords will be successfully logged in, such:

You can add 'or '1' =' 1 after any password. After adding any account and password, you can log in successfully. This is the SQL database injection, the reason is that the executed SQL statement is changed:

The above statement is actually executed

Select * from sw_user where username = 'SWIFT 'and password = '000000' or '1' = '1'

The or statement behind is always true, so the query conditions on the front are useless no matter whether they are met or not.