Thilan Dissanayaka Application Security Apr 26

SQL injection login bypass

SQL Injection (SQLi) is one of the oldest and most fundamental web application vulnerabilities. While it’s becoming rarer in modern web apps due to better coding practices and frameworks, understanding SQL injection is crucial for any beginner learning web application security.

This document will explore what SQL Injection is, how it works under the hood, and how an attacker can exploit it, using a classic login bypass as an example.

What is SQL?

SQL (Structured Query Language) is the standard language used to interact with databases. It allows you to:

Create, modify, and delete tables

Insert, fetch, update, and delete data

Handle user authentication, session management, and more

In most web applications, SQL queries are used to validate user credentials during login.

Let's start with a simple login page:

https://res.cloudinary.com/dxawocmqk/image/upload/v1745668890/hacksland/lunhsery8pnt43x7qoou.png

When a user submits the form, the web application internally checks wether a user exists or not in the database acording to the given details.

Imagine user entered the username as admin and password as p@ssword. Then the query might be a something like bellow.

"Do we have a user with username 'admin' and password 'p@ssword'?"

If the database finds a matching record, the user will be authenticated. Otherwise an error will be thrown.

To understand the SQL Injection we need to see how web application do this process under the hood. Here is a simplified version of the web application backend code.

<?php
 $username = $_POST['username'];
 $password = $_POST['password'];

 $query = "SELECT username, password FROM users WHERE username='$username' AND 
          password='$password' LIMIT 0,1";

$result = mysql_query($query);
$rows = mysql_fetch_array($result);

if ($rows) {
    echo "Login successful";
    create_session();
} else {
    echo "Login data invalid";
}
?>

What's happening here?

It reads username and password from the POST request.

It directly injects user input into an SQL query without validation or escaping.

It executes the query and checks if any rows were returned.

Here’s the structure of the SQL query:

SELECT username, password FROM users WHERE username='$username' AND password='$password' LIMIT 0,1;

Problem: Because user input is directly inserted into the SQL statement, an attacker can inject SQL code to manipulate the query.

Introduction to Fuzzing

Fuzzing is the process of feeding unexpected, random, or malicious input into a web application to find vulnerabilities.

In SQL Injection, a common fuzzing technique is to insert special characters like:

  • ' (single quote)

  • " (double quote)

  • ; (semicolon)

These characters can break SQL queries if the application isn’t properly sanitizing input.

Example: Breaking the Query Imagine you enter the following credentials:

Username: user

Password: pass'

Notice the single quote after pass.

The resulting SQL query becomes:

SELECT username, password FROM users WHERE username='user' AND password='pass'' LIMIT 0,1;

This introduces a syntax error because of the extra '.

The database throws an error:

"You have an error in your SQL syntax..."

Why? Let’s analyze:

The query expects properly closed strings like password = 'pass'.

But now it sees password='pass'', which confuses the SQL parser.

When an input breaks the SQL query, it’s often a hint that SQL Injection is possible!

Bypassing Authentication with SQL Injection

Our goal isn't just to break the query — we want to bypass login.

Let's inject a payload like:

test' OR 1=1 --

Entering this as the password, the resulting query becomes:

SELECT username, password FROM users WHERE username='user' AND password='test' OR 1=1 --' LIMIT 0,1;

Understanding This Payload 'test' is the injected password.

OR 1=1 is a logic bomb. 1=1 is always true.

-- is an SQL comment marker that tells the SQL engine to ignore the rest of the line.

Thus, the query effectively becomes:

SELECT username, password FROM users WHERE username='user' AND (password='test' OR 1=1);

Because 1=1 is always true, the password check is bypassed, and the login succeeds!

Bypassing Without Knowing the Username What if you don't even know the username?

Simple — modify the username field too:

Username: user' OR 1=1 --

Password: anything

Resulting query:

SELECT username, password FROM users WHERE username='user' OR 1=1 --' AND password='anything' LIMIT 0,1;

Here’s what happens:

username='user' OR 1=1 will always return true because of OR 1=1.

-- comments out the password check and the LIMIT clause.

Login bypass achieved!

Why Does SQL Injection Work Here? User input is directly embedded into the SQL query.

No validation or escaping of special characters (', ", --).

The attacker uses Boolean logic (OR 1=1) to bypass authentication.

SQL comments (--) are used to ignore the rest of the query.

Even though modern frameworks have better defenses (like prepared statements and ORM layers), SQL Injection remains a critical concept to understand for:

Web application penetration testing

Secure coding practices

Building a security-first mindset

Always sanitize, validate, and use parameterized queries when handling user input!

ALSO READ
ACID Properties in Databases: The Key to Reliable Transactions
Apr 25 Database Systems

When working with databases, one thing is absolutely critical: keeping your data safe, consistent, and reliable. That's where ACID properties come in — a set of principles that ensure every....

Adapter Pattern explained simply
Apr 26 Software Architecture

Ever needed to connect two incompatible interfaces without changing their source code? That’s exactly where the **Adapter Pattern** shines! The Adapter Pattern is a structural design pattern....

SSRF - Server Side Request Forgery
May 27 Application Security

Server-Side Request Forgery (SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's....

REST API - Interview preparation guide
May 08 Interview Guides

## What is a REST API? A REST (Representational State Transfer) API is an architectural style for designing networked applications. It uses standard HTTP methods to interact with resources, making....

Remote Command Execution
Mar 23 Application Security

Remote Command Execution (RCE) is a critical security vulnerability that allows an attacker to execute arbitrary commands on a remote server. This vulnerability can lead to unauthorized access, data....

Common Web Application Attacks
May 17 Application Security

Web applications are one of the most targeted surfaces by attackers. This is primarily because they are accessible over the internet, making them exposed and potentially vulnerable. Since these....