~/ learn/ comp-400/ cards/ Granting rights, and the injection that ignores them
1 of 8

The sentence the database actually parses after a tautology is injected

The sentence the database actually parses after a tautology is injected

Answer

SELECT id, email FROM staff WHERE surname = '' OR 1=1 --' AND active = TRUE;

The closing quote ended the literal early, `OR 1=1` made the WHERE clause universally true, and `--` turned everything after it — including the `active` filter the application wrote — into a comment. The parser behaved perfectly; it was simply handed a different sentence.

Stallings & Brown, Computer Security 5e, ch5 §5.1–§5.5

space flip · ← → navigate · esc to exit
NORMAL ~/memra/library/c0f7efc7-5ca9-4604-a46d-3a6a583fa1a6/flashcard utf-8 LF