SQL Injection Bypass in Login Forms

SQL Injection

Answer Correct answer: B — The server executes a query where the username field is closed, 'or 1=1' forces a true condition, and '--' comments out the password check.

Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following credentials: Based on the above credentials, which of the following SQL commands are you expecting to be executed by the server, if there is indeed an SQL injection vulnerability? -

select * from Users where UserName = ‘attack’ ’ or 1=1 -- and UserPassword = ‘123456’
select * from Users where UserName = ‘attack’ or 1=1 -- and UserPassword = ‘123456’ Correct Answer
select * from Users where UserName = ‘attack or 1=1 -- and UserPassword = ‘123456’
select * from Users where UserName = ‘attack’ or 1=1 --’ and UserPassword = ‘123456’

Community Votes

67%

33%

67% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The core concept tested is how an attacker closes the original single quote, injects 'OR 1=1', and uses '--' to nullify the remaining WHERE clause conditions.

This question explores the mechanics of SQL injection within a Microsoft SQL Server login form, specifically how input manipulation alters the backend query structure. The correct answer identifies the precise syntax required to close the initial string, inject a tautology, and comment out the password validation.

Many learners select Option D because they assume the closing quote from the original query must appear after the comment symbol. However, this results in invalid SQL syntax where the comment effectively ignores that trailing quote, leaving the statement malformed or logically incorrect for the specific injection payload.

Community Discussion (8 comments)

NikoTomas 👍 2 Selected: D

Correct is D. In B option, there is missing apostrophe ' after --. This is exacly like example from PortSwigger (link below): Original query: SELECT FROM products WHERE category = ' ' AND released = 1 ...leads to this when you instert Gifts' OR 1=1-- (note the original apostrophe after the -- in the result): SELECT FROM products WHERE category = 'Gifts' OR 1=1--' AND released = 1 ...the apostrophe from inserted string Gifts' OR 1=1-- was in the resulting query paired with the leading original apostrophe and originaly enclosing aspostrophe pair still exist after our inserted string - at the and of 'Gifts' OR 1=1--' https://portswigger.net/web-security/sql-injection

agastya_5272 👍 1 Selected: B

in the D option there is syntaxt error extra envoted comma.

killwitch 👍 1 Selected: B

B. select from Users where UserName = ‘attack’ or 1=1 -- and UserPassword = ‘123456’. attack' or 1=1 -- is a classic SQL injection attempt. Let's break it down: attack' - Closes the existing UserName string. or 1=1 - Always evaluates to true, bypassing authentication. -- This is a SQL comment that ignores everything after it (including the password check). Now, inserting this into a vulnerable SQL query: SELECT FROM Users WHERE UserName = 'attack' or 1=1 --' AND UserPassword = '123456' After the -- comment truncates the rest of the query, it effectively becomes: SELECT * FROM Users WHERE UserName = 'attack' OR 1=1; Since 1=1 is always true, this query returns all users, allowing unauthorized access.

HeyacedoGomez 👍 2 Selected: B

Option A: Incorrect due to an extra or misplaced quotation mark (‘attack’ ’). Option B: Correct SQL syntax. The condition OR 1=1 makes the WHERE clause always true, and -- starts a comment, ignoring everything after it. Option C: Incorrect because the string 'attack or 1=1 -- is not properly enclosed in quotes. Option D: Incorrect due to --’, which incorrectly uses both the comment symbol and a quotation mark.

SNimlaka 👍 3 Selected: B

The answer should be B.

cb56e21 👍 1 Selected: B

it should be B since we are passing directly the user input

MHafizC 👍 1 Selected: D

D is the answer. Refer to the book.

tong0819 👍 1 Selected: D

Answer is D.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option B represents the standard successful SQL injection payload structure when injected into a username field. The input 'attack' closes the opening single quote of the UserName parameter. The 'or 1=1' part creates a condition that always evaluates to true, bypassing authentication. The '--' sequence initiates a comment, instructing the SQL Server to ignore all subsequent characters in the query string, including the rest of the WHERE clause (such as the password check). This results in a syntactically valid and logically exploitable command.

Why the Other Options Are Wrong

Option A contains a syntax error with an extra misplaced apostrophe ('attack’ ’). Option C incorrectly merges the username value with the injection logic without proper closure of the first string, resulting in 'attack or 1=1 -- which treats the entire string as a literal value rather than executable logic. Option D includes a trailing single quote after the comment symbol ('--'). In SQL, everything after '--' is ignored; therefore, having a stray quote there does not make the query valid in the way intended by the injection, and often leads to syntax errors if the parser expects strict termination, whereas Option B cleanly terminates the logic via the comment.

Community Comment Notes

Community consensus is split between B and D, but technical analysis strongly favors B. Users like NikoTomas argue for D based on PortSwigger examples, noting that the original query's closing quote might remain visible in the final executed string. However, as HeyacedoGomez points out, Option B provides the correct SQL syntax where the comment properly negates the rest of the query. The key distinction is that '--' makes everything after it irrelevant, so the presence or absence of a trailing quote is less critical than the clean execution of the bypass logic found in B.

Exam Strategy

When analyzing SQL injection options, look for the sequence: Close Quote -> Inject Logic (e.g., OR 1=1) -> Comment Out Rest (--). Ensure the resulting full query is syntactically valid SQL. Do not get distracted by the exact visual representation of the original query's closing quote if the comment symbol renders it moot.

Frequently Asked Questions

Why is Option D considered incorrect despite some community votes?

Option D includes a trailing quote after the comment symbol '--'. Since '--' ignores all subsequent text, that quote is syntactically orphaned or ignored, making B the cleaner, standard injection payload that reliably bypasses the check.

What happens if I don't use '--' in the injection?

Without '--', the SQL parser will attempt to execute the remaining parts of the original query (like the password comparison), likely causing a syntax error or failing the authentication check because the logical structure remains intact.

More 312-50v13 FAQ →

Related Analysis

← Back to 312-50v13 Study Guide