Why does this SQL injection have an equals symbol?

Question

I was reading into the basics of SQL injection attacks on w3schools here.

In the second example, I was curious as to why the equal sign was used. I have quoted within the line below.

" or ""="

Is there any particular reason why an equals sign was used, or is it a placeholder for any character or symbol? Included below is an extract from the tutorial.

uName = getRequestString("username");
uPass = getRequestString("userpassword");

sql = 'SELECT * FROM Users WHERE Name ="' + uName + '" AND Pass ="' + uPass + '"'

Here is an example where credentials are John Doe and myPass.

SELECT * FROM Users WHERE Name ="John Doe" AND Pass ="myPass"

Using the " or ""=" as a username and password results in the follow SQL statement being executed by the database.

SELECT * FROM Users WHERE Name ="" or ""="" AND Pass ="" or ""=""

I cannot picture in my mind how that would work, causing the SELECT * to reveal everything in the USERS table?

Answer 1

In SQL operator "AND" has higher precedence than "OR". Let add parentheses, to make the logic more clear:

SELECT * FROM Users WHERE (Name ="") or (""="" AND Pass ="") or (""="")

Assuming there are no empty names, the 1st expression, (Name =""), will hold false for all rows. Because of similar reason, Pass ="" will hold false and thus the whole 2nd expression (""="" AND Pass ="") will hold false for all rows. But the 3rd expression, (""=""), will hold true for all rows.

Thus, the WHERE clause will be equivalent to true:

SELECT * FROM Users WHERE (false) or (false) or (true)

Means:

SELECT * FROM Users WHERE (true)

In SQL there are no constants false and true. I use them only to make the effect easier to understand.

Since the WHERE clause computes to true for all rows, this SQL will return all rows from the table. If the login function tests if the result is not empty, such check will succeed, and the login will be accepted.