I was testing SQLI Cheatsheets on a vulnerable test site.
This particular injection
'=' 'OR' seems to work on the login page.
Why does that injection work? What's the back-end SQL code, if I could imagine myself?
I used Burp Suite to see if I am able to get a clear look at what's passed in. This is the result of Burp Suite on my end:
Turns out its
password from the back-end SQL query code?
But how do I picture this? Is it something like this below?
SELECT * FROM USERS WHERE uid=''=' 'OR'' AND pwd='test'
Could anyone explain how this cheatsheet
'=' 'OR' works? Might also as well tell me how can I picture the back-end SQL query code. Assuming I do not have access to the back-end code as I am pentesting the login page.