I read everywhere regarding SQL injection where it is said that if SQL query is:
SELECT * FROM table_name where username='xxxxx' AND password ='xxxx'
and if you want to enter always true condition then you will have to use
'OR 1=1-- then the query will be:
SELECT * FROM table_name where username=''OR 1=1--' AND password ='xxxx'
The logic behind the SQL query is simple since OR
1=1 is always true that is why it has been executed. However
3>2 will always be considered true but why don't we use
'OR 1 expression in SQL injection?