1

I was reading into the basics of SQL injection attacks on w3schools here.

In the second example, I was curious as to why the equal sign was used. I have quoted within the line below.

" or ""="

Is there any particular reason why an equals sign was used, or is it a placeholder for any character or symbol? Included below is an extract from the tutorial.

uName = getRequestString("username");
uPass = getRequestString("userpassword");

sql = 'SELECT * FROM Users WHERE Name ="' + uName + '" AND Pass ="' + uPass + '"'

Here is an example where credentials are John Doe and myPass.

SELECT * FROM Users WHERE Name ="John Doe" AND Pass ="myPass"

Using the " or ""=" as a username and password results in the follow SQL statement being executed by the database.

SELECT * FROM Users WHERE Name ="" or ""="" AND Pass ="" or ""=""

I cannot picture in my mind how that would work, causing the SELECT * to reveal everything in the USERS table?

1 Answer 1

5

In SQL operator "AND" has higher precedence than "OR". Let add parentheses, to make the logic more clear:

SELECT * FROM Users WHERE (Name ="") or (""="" AND Pass ="") or (""="")

Assuming there are no empty names, the 1st expression, (Name =""), will hold false for all rows. Because of similar reason, Pass ="" will hold false and thus the whole 2nd expression (""="" AND Pass ="") will hold false for all rows. But the 3rd expression, (""=""), will hold true for all rows.

Thus, the WHERE clause will be equivalent to true:

SELECT * FROM Users WHERE (false) or (false) or (true)

Means:

SELECT * FROM Users WHERE (true)

In SQL there are no constants false and true. I use them only to make the effect easier to understand.

Since the WHERE clause computes to true for all rows, this SQL will return all rows from the table. If the login function tests if the result is not empty, such check will succeed, and the login will be accepted.

5
  • Question 1. But the 3rd expression, (""=""), will hold true for all rows. <--- Why would it hold true for ""="" because what I input into the username and password field was different? I put " or ""=" which looks different.
    – questioner
    May 5 at 10:47
  • Question 2. How comes you did not write Something=""="" like you did with Name="" and Pass="" because I tried this with an SQL DBMS on some sample data and kept on getting no results? I am sure it is some syntax rule I am unaware of. Perhaps it is purposely wrong to cause a False evaluation? Sorry for my questions, your answer was amazing!
    – questioner
    May 5 at 10:50
  • UPDATE sorry it means does empty string equal empty string "" = "" I see, just like 1 = 1 to make it evaluate to True!
    – questioner
    May 5 at 11:02
  • @questioner: I don't understand you question 2. Why do you expect I should have written word "Something"? There is particular SQL. It contains particular field names "Name" and "Pass". I am just explaining how this particular SQL works. And I don't understand what your mean by "it is some syntax rule I am unaware of".
    – mentallurg
    May 5 at 20:56
  • Sorry, what I did not realise earlier was ""="" was comparing two empty strings which evaluates to true, I stupidly thought it was checking whether the username or password field contained that string.
    – questioner
    May 6 at 9:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.