I was doing some homework for my security class involving SQL injections. I found that I could do a shorter SQL injection than the typical ' OR '1'=1
example. Instead I could do '='
. Typing this is in to the password field of a typical login boxes gives a SQL query like this:
SELECT * FROM Users WHERE username='user' AND password=''='';
It turns out that password=''=''
evaluates to 1
, allowing the SQL injection to work.
After doing some more testing, I saw that if I test if a string is equal to 0, it returns 1:
SELECT 0='a';
So in my example, password=''
would evaluate to 0 and 0=''
would end up evaluating to 1.
My testing showed me how this is happening, but I want know why this happens (i.e why is 0='a'
true?.
banana
on this page: grimoire.ca/mysql/choose-something-else