SQL Injection Bypass in Login Forms

312-50v13 By islever Editorial Last updated

SQL Injection

Short answer

B The server executes a query where the username field is closed, 'or 1=1' forces a true condition, and '--' comments out the password check.

Question

Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following credentials: Based on the above credentials, which of the following SQL commands are you expecting to be executed by the server, if there is indeed an SQL injection vulnerability? - Exhibit: SQL Injection Bypass in Login Forms
  1. select * from Users where UserName = ‘attack’ ’ or 1=1 -- and UserPassword = ‘123456’
  2. select * from Users where UserName = ‘attack’ or 1=1 -- and UserPassword = ‘123456’ Correct Answer
  3. select * from Users where UserName = ‘attack or 1=1 -- and UserPassword = ‘123456’
  4. select * from Users where UserName = ‘attack’ or 1=1 --’ and UserPassword = ‘123456’

Key Takeaways

The core concept tested is how an attacker closes the original single quote, injects 'OR 1=1', and uses '--' to nullify the remaining WHERE clause conditions.

This question explores the mechanics of SQL injection within a Microsoft SQL Server login form, specifically how input manipulation alters the backend query structure. The correct answer identifies the precise syntax required to close the initial string, inject a tautology, and comment out the password validation.

Common mistake: Many learners select Option D because they assume the closing quote from the original query must appear after the comment symbol. However, this results in invalid SQL syntax where the comment effectively ignores that trailing quote, leaving the statement malformed or logically incorrect for the specific injection payload.

Expert Analysis

Why the Answer Is Correct

Option B represents the standard successful SQL injection payload structure when injected into a username field. The input 'attack' closes the opening single quote of the UserName parameter. The 'or 1=1' part creates a condition that always evaluates to true, bypassing authentication. The '--' sequence initiates a comment, instructing the SQL Server to ignore all subsequent characters in the query string, including the rest of the WHERE clause (such as the password check). This results in a syntactically valid and logically exploitable command.

Why the Other Options Are Wrong

Option A contains a syntax error with an extra misplaced apostrophe ('attack’ ’). Option C incorrectly merges the username value with the injection logic without proper closure of the first string, resulting in 'attack or 1=1 -- which treats the entire string as a literal value rather than executable logic. Option D includes a trailing single quote after the comment symbol ('--'). In SQL, everything after '--' is ignored; therefore, having a stray quote there does not make the query valid in the way intended by the injection, and often leads to syntax errors if the parser expects strict termination, whereas Option B cleanly terminates the logic via the comment.

Community Comment Notes

Community consensus is split between B and D, but technical analysis strongly favors B. Users like NikoTomas argue for D based on PortSwigger examples, noting that the original query's closing quote might remain visible in the final executed string. However, as HeyacedoGomez points out, Option B provides the correct SQL syntax where the comment properly negates the rest of the query. The key distinction is that '--' makes everything after it irrelevant, so the presence or absence of a trailing quote is less critical than the clean execution of the bypass logic found in B.

Exam Strategy

When analyzing SQL injection options, look for the sequence: Close Quote -> Inject Logic (e.g., OR 1=1) -> Comment Out Rest (--). Ensure the resulting full query is syntactically valid SQL. Do not get distracted by the exact visual representation of the original query's closing quote if the comment symbol renders it moot.

Frequently Asked Questions

Why is Option D considered incorrect despite some community votes?

Option D includes a trailing quote after the comment symbol '--'. Since '--' ignores all subsequent text, that quote is syntactically orphaned or ignored, making B the cleaner, standard injection payload that reliably bypasses the check.

What happens if I don't use '--' in the injection?

Without '--', the SQL parser will attempt to execute the remaining parts of the original query (like the password comparison), likely causing a syntax error or failing the authentication check because the logical structure remains intact.

More 312-50v13 FAQ →

Community Votes

B
67%
D
33%

67% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. NikoTomas 👍 2 Answered D
    Correct is D. In B option, there is missing apostrophe ' after --. This is exacly like example from PortSwigger (link below): Original query: SELECT FROM products WHERE category = ' ' AND released = 1 ...leads to this when you instert Gifts' OR 1=1-- (note the original apostrophe after the -- in the result): SELECT FROM products WHERE category = 'Gifts' OR 1=1--' AND released = 1 ...the apostrophe from inserted string Gifts' OR 1=1-- was in the resulting query paired with the leading original apostrophe and originaly enclosing aspostrophe pair still exist after our inserted string - at the and of 'Gifts' OR 1=1--' https://portswigger.net/web-security/sql-injection
  2. HeyacedoGomez 👍 2 Answered B
    Option A: Incorrect due to an extra or misplaced quotation mark (‘attack’ ’). Option B: Correct SQL syntax. The condition OR 1=1 makes the WHERE clause always true, and -- starts a comment, ignoring everything after it. Option C: Incorrect because the string 'attack or 1=1 -- is not properly enclosed in quotes. Option D: Incorrect due to --’, which incorrectly uses both the comment symbol and a quotation mark.
  3. killwitch 👍 1 Answered B
    B. select from Users where UserName = ‘attack’ or 1=1 -- and UserPassword = ‘123456’. attack' or 1=1 -- is a classic SQL injection attempt. Let's break it down: attack' - Closes the existing UserName string. or 1=1 - Always evaluates to true, bypassing authentication. -- This is a SQL comment that ignores everything after it (including the password check). Now, inserting this into a vulnerable SQL query: SELECT FROM Users WHERE UserName = 'attack' or 1=1 --' AND UserPassword = '123456' After the -- comment truncates the rest of the query, it effectively becomes: SELECT * FROM Users WHERE UserName = 'attack' OR 1=1; Since 1=1 is always true, this query returns all users, allowing unauthorized access.
  4. agastya_5272 👍 1 Answered B
    in the D option there is syntaxt error extra envoted comma.
  5. cb56e21 👍 1 Answered B
    it should be B since we are passing directly the user input
Show 3 more comments
  1. MHafizC 👍 1 Answered D
    D is the answer. Refer to the book.
  2. SNimlaka 👍 3 Answered B
    The answer should be B.
  3. tong0819 👍 1 Answered D
    Answer is D.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

Session Donation vs. Session Fixation Attack

S-grade

← Back to 312-50v13 Study Guide