I am a software developer starting studying application security and I have the following doubt related SQL injection.
I am following a video course and there are these two examples:
I have an insecure SQL query like this:
txtSql = "SELECT * FROM Users WHERE UserId = " + txtUserId
If the passed value of
txtUserIdis something like
99 OR 1 = 1, I will obtain a query like this
SELECT * FROM Users WHERE UserId = 99 OR 1 = 1
which will return me the entire list of record contained in the
1 = 1is always true and the
ORconcatenation will return true so it is like this query:
SELECT * FROM Users WHERE TRUE
returning me the entire list of records. Is this reasoning correct?
Then I have this second more sophisticated example:
There is a user login form (username and password). Behind this form there is this insecure query implementation:
sql = 'SELECT * FROM USERS WHERE Name = "' + uName + '" AND Pass = "' + uPass + '"'
If the user inserts the following data into the login form:
uName = " OR ""=" uPass = " OR ""="
The result query will be:
SELECT * FROM Users WHERE Name = "" OR ""="" AND Pass = "" OR ""=""
So it is selecting records where
Namefield is empty ("") or equal to
"="(and this condition should be always false because it is pretty strange to have an empty user name or an username like "=").
Passfield is empty ("") or equal to
"="(and this condition should be always false because it is pretty strange to have an empty password or a password like "=").
So we have a conditional like:
WHERE FALSE AND FALSE
And here my doubt:
FALSE AND FALSE = FALSE
Why does it say that this query returns me the entire list of records of the user table?
If I understood the logic correctly, the second query should translated to something like this:
SELECT * FROM Users WHERE FALSE AND FALSE
What is wrong in my reasoning? What am I missing?