-1

I read everywhere regarding SQL injection where it is said that if SQL query is:

SELECT * FROM table_name where username='xxxxx' AND password ='xxxx'

and if you want to enter always true condition then you will have to use 'OR 1=1-- then the query will be:

SELECT * FROM table_name where username=''OR 1=1--' AND password ='xxxx'

The logic behind the SQL query is simple since OR 1=1 is always true that is why it has been executed. However 2>1, 3>2 will always be considered true but why don't we use 'OR 2>1,'OR 1 expression in SQL injection?

2
  • 7
    No one says that you have to use OR 1=1. It's just easier to explain for those who are new, and because it's "expected", then even experts understand what the clause is meant to do.
    – schroeder
    May 17, 2020 at 19:50
  • 4
    You orignally tagged this with OWASP Top 10. Even OWASP's documentation uses an example clause of 'a'='a'. owasp.org/www-community/attacks/SQL_Injection So, it appears that or premise for the question is faulty.
    – schroeder
    May 17, 2020 at 19:52

2 Answers 2

3

It's just a simple string used to test the SQL statement. There's no requirement to use 1=1 exactly. Like you say 5>3 would work in the exact same way.

Unfortunately 1=1 is so common that it triggers protection code. Weakly protected code could be vulnerable to SQL injection and fail the or 1=1; test. So it does make sense to vary sometimes.

2

You can use any expression that evaluates to true, it doesn't have to be 1=1, I don't think SQL contains a literal value for true according to this.

1=1 is the easiest for me to write and I got used to it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .