I was reading into the basics of SQL injection attacks on w3schools here.
In the second example, I was curious as to why the equal sign was used. I have quoted within the line below.
" or ""="
Is there any particular reason why an equals sign was used, or is it a placeholder for any character or symbol? Included below is an extract from the tutorial.
uName = getRequestString("username"); uPass = getRequestString("userpassword"); sql = 'SELECT * FROM Users WHERE Name ="' + uName + '" AND Pass ="' + uPass + '"'
Here is an example where credentials are John Doe and myPass.
SELECT * FROM Users WHERE Name ="John Doe" AND Pass ="myPass"
Using the " or ""=" as a username and password results in the follow SQL statement being executed by the database.
SELECT * FROM Users WHERE Name ="" or ""="" AND Pass ="" or ""=""
I cannot picture in my mind how that would work, causing the SELECT * to reveal everything in the USERS table?