The sentence the database actually parses after a tautology is injected
The sentence the database actually parses after a tautology is injected
Answer
SELECT id, email FROM staff WHERE surname = '' OR 1=1 --' AND active = TRUE;
The closing quote ended the literal early, `OR 1=1` made the WHERE clause universally true, and `--` turned everything after it — including the `active` filter the application wrote — into a comment. The parser behaved perfectly; it was simply handed a different sentence.
Stallings & Brown, Computer Security 5e, ch5 §5.1–§5.5