Given the vulnerable query: SELECT * FROM users WHERE username = '" + userInput + "'; If userInput is admin' OR '1'='1, what will the query become and what is the likely result?
ASyntax error due to unmatched quotes
BSELECT * FROM users WHERE username = 'admin OR 1=1'; -- Returns no users
CSELECT * FROM users WHERE username = 'admin'; -- Returns only admin user
DSELECT * FROM users WHERE username = 'admin' OR '1'='1'; -- Returns all users
Step-by-Step Solution
Solution:
Step 1: Substitute userInput into the query
The query becomes: SELECT * FROM users WHERE username = 'admin' OR '1'='1';
Step 2: Understand the effect of OR '1'='1'
The condition '1'='1' is always true, so the WHERE clause matches all rows.
Final Answer:
SELECT * FROM users WHERE username = 'admin' OR '1'='1'; -- Returns all users -> Option D
Quick Check:
Injected OR '1'='1' returns all rows [OK]
Quick Trick:OR '1'='1' always true returns all rows [OK]
Common Mistakes:
Thinking it causes syntax error
Assuming it returns only admin user
Misreading the injected condition
Master "Security Basics" in SQL
9 interactive learning modes - each teaches the same concept differently
