Adopted from wikipedia, SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application.
SQL Injection happens when an application accepts user input that is directly placed into a SQL Statement and doesn’t properly filter out dangerous characters. For example a simple basic HTML form with two inputs, login and password. The easiest way for the application to work is by building a database query that looks like this:
SELECT id
FROM login
WHERE username = ‘$username’
AND password = ‘$password’
Suppose that we gave “John” as a username and “‘anypassword’ OR 1=1″ as password. If the variables $username and $password are requested directly from the user’s input and not properly sanitised, the variable $password has turned the WHERE SQL command into a two-component clause separated by ‘OR’.
The 1=1 part guarantees to be always true regardless of what the first part contains. This will allow the attacker to bypass the login form without actually knowing a valid username and password combination.
