Let's say my username is theusername and my password is thepassword. If use those credentials I login as expected. However if I add whatever at the END of the username, say theusername.random.stuff.at.the.end, I still get to login to my account. Doesn't work if I do that at the beginning.
Also, if I put an odd number of single quotes at the end whether I add the other random stuff or not (Example: theusername' or theusername.random'''), it won't let me in. Won't match any username in the DB. It will let me in if the number of single quotes is even though.
And lastly, if the username ends with a single quote and double dash (Example: theusername'--) it will take it as a valid username (It matches the username in the DB) but will say the password is wrong even if I submit the actual password.
I know when a submitted username matches an username in the DB because the page shows a different error for when the username is bad and when the password is bad.
My question is... Knowing they are using T-SQL, what query string are they possibly using?
Thanks in advance.