I have read somewhere that in SQL injection attacks the attackers use such keywords into application entry points. Whats the purpose of doing this?
AND 1=0 always evaluates to
false and therefore the query always returns an empty set, e.g. if the SQL fragment in the application is
SELECT * FROM users WHERE username = '<placeholder>'
then I can turn this query to
SELECT * FROM users WHERE username = 'admin' AND 1=0 --'
admin' AND 1=0 -- as value for the placeholder.
I can now insert a second statement which is executed instead of the intended one, e.g.
SELECT * FROM users WHERE username = 'admin' AND 1=0; TRUNCATE TABLE users; --'
Here I will empty the table
users as attack.
Another thing used is
OR 1=1 which always evaluated to
true. This is used to query a whole table and eliminate the where-caluse completely, e.g.
SELECT * FROM users WHERE username = 'admin' OR 1=1 --'
This is achieved by using
admin' OR 1=1 -- as the placeholder in the above example.
In this case the complete table
users will be returned.
1=0 is always false, so a clause containing
AND 1=0 will also always be false. This, like the always-true
OR 1=1, can be used to bypass the conditions in a
OR 1=1 variant is more generally useful (eg.
SELECT username WHERE userid=173 to get your username becomes
SELECT username WHERE userid=173 OR 1=1 to get every username on the system), but the
AND 1=0 variant can, for example, be used to bypass a "is this user already registered" check.