7

I have read somewhere that in SQL injection attacks the attackers use such keywords into application entry points. Whats the purpose of doing this?

4
  • 4
    Please do more research before asking. As the site's page explains, this site is for for Information Security professionals. If you have a question about a basic topic like SQL injection, I expect you to do research first to read existing resources about SQL injection before asking here. In this case, your question is well covered by existing resources, so there would not be a lot of point in us duplicating all of those existing resources. Why don't you tell us what study and research you have done and what specifically you found confusing?
    – D.W.
    Sep 25, 2014 at 22:54
  • 2
    Also in the future you should give the precise reference where you saw this, so people have enough context to explain it for you.
    – D.W.
    Sep 25, 2014 at 22:56
  • 1
    See also security.stackexchange.com/q/8761/971
    – D.W.
    Sep 25, 2014 at 22:57
  • 1
    @mac For balance, we also have the How to Ask page, clearly stating prior research requirement. Mostly to avoid needless duplication of contents, but it should also prevent trivial questions being asked.
    – TildalWave
    Sep 26, 2014 at 12:19

2 Answers 2

20

The fragment AND 1=0 always evaluates to false and therefore the query always returns an empty set, e.g. if the SQL fragment in the application is

SELECT * FROM users WHERE username = '<placeholder>'

then I can turn this query to

SELECT * FROM users WHERE username = 'admin' AND 1=0 --'

when using admin' AND 1=0 -- as value for the placeholder.

I can now insert a second statement which is executed instead of the intended one, e.g.

SELECT * FROM users WHERE username = 'admin' AND 1=0; TRUNCATE TABLE users; --'

Here I will empty the table users as attack.

Another thing used is OR 1=1 which always evaluated to true. This is used to query a whole table and eliminate the where-caluse completely, e.g.

SELECT * FROM users WHERE username = 'admin' OR 1=1 --'

This is achieved by using admin' OR 1=1 -- as the placeholder in the above example.

In this case the complete table users will be returned.

7
  • 1
    Why not just say SELECT * from users, why do you need to add the additional WHERE statement?
    – GdD
    Sep 25, 2014 at 10:32
  • 9
    @GdD, remember this is an attack against a website. The website's original code is "SELECT * FROM users WHERE username = " and you enter "'admin' OR 1=1" If you concatenate these values you get "SELECT * FROM users WHERE username = 'admin' OR 1=1" which will return the whole user table. Sep 25, 2014 at 11:05
  • 1
    @GdD edited answer to be more clear.
    – Uwe Plonus
    Sep 25, 2014 at 11:32
  • 1
    Ah, I see @ChrisMurray, because the value is not sanitized it will simply run it as-is.
    – GdD
    Sep 25, 2014 at 11:50
  • 1
    Since … OR 1=1 is true for all records, you may also alter/delete all records if it’s not a SELECT but an UPDATE or DELETE statement which gets executed.
    – Gumbo
    Sep 25, 2014 at 12:58
6

1=0 is always false, so a clause containing AND 1=0 will also always be false. This, like the always-true OR 1=1, can be used to bypass the conditions in a WHERE clause.

The OR 1=1 variant is more generally useful (eg. SELECT username WHERE userid=173 to get your username becomes SELECT username WHERE userid=173 OR 1=1 to get every username on the system), but the AND 1=0 variant can, for example, be used to bypass a "is this user already registered" check.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .