Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/*
Assuming I am testing it on this server-side code below.
SELECT * FROM users WHERE login='$login' AND password='$password';
Well I can't seem to bypass it with that cheat sheet. I am just curious why do they include it as a cheat sheet instead? How is that particular cheat sheet used?
What I am guessing and using my logic is there is only possibility of this cheat sheet usage is where the programmer mistakenly placed the ending comment tag */ behind the SQL query as shown in the server-side code below.
SELECT * FROM users WHERE login='' or 1=1/*' AND password='$password' */;
Feel free to explain the usage and also possibly verify my own understanding of this particular cheat sheet's usage instead.
Edited : For misunderstandings , what I meant for */ at the end of the code as mentioned if a programmer mistakenly put it is shown below.
SELECT * FROM users WHERE login='$login' AND password='$password' */;