I was wondering while testing my website that is there any way that the user can fetch data from my database by making some further modification in the following query
SELECT * FROM users WHERE login='admin' AND password='1' OR '1'='1';
provided that he knew admin
username and used '1'='1'
for password to hack into it.
What else can he add to echo the password on screen or find table details?
I want to do this to understand the limits the unprotected SQL
can harm us for my presentation on SQL injection
='1' OR '1'='1'
come from?' OR '1'='1';
part is the hack itself - something that attacker put into password field of your form. Then it make sense