Thilan Dissanayaka Web App Hacking Apr 26

SQL injection login bypass

SQL Injection (SQLi) is one of the oldest and most fundamental web application vulnerabilities. While it’s becoming rarer in modern web apps due to better coding practices and frameworks, understanding SQL injection is crucial for any beginner learning web application security.

This document will explore what SQL Injection is, how it works under the hood, and how an attacker can exploit it, using a classic login bypass as an example.

What is SQL?

SQL (Structured Query Language) is the standard language used to interact with databases. It allows you to:

Create, modify, and delete tables

Insert, fetch, update, and delete data

Handle user authentication, session management, and more

In most web applications, SQL queries are used to validate user credentials during login.

Let's start with a simple login page:

https://res.cloudinary.com/dxawocmqk/image/upload/v1745668890/hacksland/lunhsery8pnt43x7qoou.png

When a user submits the form, the web application internally checks wether a user exists or not in the database acording to the given details.

Imagine user entered the username as admin and password as p@ssword. Then the query might be a something like bellow.

"Do we have a user with username 'admin' and password 'p@ssword'?"

If the database finds a matching record, the user will be authenticated. Otherwise an error will be thrown.

To understand the SQL Injection we need to see how web application do this process under the hood. Here is a simplified version of the web application backend code.

<?php
 $username = $_POST['username'];
 $password = $_POST['password'];

 $query = "SELECT username, password FROM users WHERE username='$username' AND 
          password='$password' LIMIT 0,1";

$result = mysql_query($query);
$rows = mysql_fetch_array($result);

if ($rows) {
    echo "Login successful";
    create_session();
} else {
    echo "Login data invalid";
}
?>

What's happening here?

It reads username and password from the POST request.

It directly injects user input into an SQL query without validation or escaping.

It executes the query and checks if any rows were returned.

Here’s the structure of the SQL query:

SELECT username, password FROM users WHERE username='$username' AND password='$password' LIMIT 0,1;

Problem: Because user input is directly inserted into the SQL statement, an attacker can inject SQL code to manipulate the query.

Introduction to Fuzzing

Fuzzing is the process of feeding unexpected, random, or malicious input into a web application to find vulnerabilities.

In SQL Injection, a common fuzzing technique is to insert special characters like:

  • ' (single quote)

  • " (double quote)

  • ; (semicolon)

These characters can break SQL queries if the application isn’t properly sanitizing input.

Example: Breaking the Query Imagine you enter the following credentials:

Username: user

Password: pass'

Notice the single quote after pass.

The resulting SQL query becomes:

SELECT username, password FROM users WHERE username='user' AND password='pass'' LIMIT 0,1;

This introduces a syntax error because of the extra '.

The database throws an error:

"You have an error in your SQL syntax..."

Why? Let’s analyze:

The query expects properly closed strings like password = 'pass'.

But now it sees password='pass'', which confuses the SQL parser.

When an input breaks the SQL query, it’s often a hint that SQL Injection is possible!

Bypassing Authentication with SQL Injection

Our goal isn't just to break the query — we want to bypass login.

Let's inject a payload like:

test' OR 1=1 --

Entering this as the password, the resulting query becomes:

SELECT username, password FROM users WHERE username='user' AND password='test' OR 1=1 --' LIMIT 0,1;

Understanding This Payload 'test' is the injected password.

OR 1=1 is a logic bomb. 1=1 is always true.

-- is an SQL comment marker that tells the SQL engine to ignore the rest of the line.

Thus, the query effectively becomes:

SELECT username, password FROM users WHERE username='user' AND (password='test' OR 1=1);

Because 1=1 is always true, the password check is bypassed, and the login succeeds!

Bypassing Without Knowing the Username What if you don't even know the username?

Simple — modify the username field too:

Username: user' OR 1=1 --

Password: anything

Resulting query:

SELECT username, password FROM users WHERE username='user' OR 1=1 --' AND password='anything' LIMIT 0,1;

Here’s what happens:

username='user' OR 1=1 will always return true because of OR 1=1.

-- comments out the password check and the LIMIT clause.

Login bypass achieved!

Why Does SQL Injection Work Here? User input is directly embedded into the SQL query.

No validation or escaping of special characters (', ", --).

The attacker uses Boolean logic (OR 1=1) to bypass authentication.

SQL comments (--) are used to ignore the rest of the query.

Even though modern frameworks have better defenses (like prepared statements and ORM layers), SQL Injection remains a critical concept to understand for:

Web application penetration testing

Secure coding practices

Building a security-first mindset

Always sanitize, validate, and use parameterized queries when handling user input!

ALSO READ
ACID Properties in Databases: The Key to Reliable Transactions
Apr 25 Database Systems

When working with databases, one thing is absolutely critical: keeping your data safe, consistent, and reliable. That's where ACID properties come in — a set of principles that ensure every....

Boolean based Blind SQL Injection
Apr 26 Web App Hacking

Blind SQL Injection happens when: There is a SQL injection vulnerability, BUT the application does not show any SQL errors or query outputs directly. In this case, an attacker has to ask....

Tic-Tac-Toe Game with Atmega 256 MicroController
Mar 23 Software Architecture

In this blog, I’ll walk you through how I built a **Tic-Tac-Toe game** using an AVR microcontroller, a 4x3 keypad, and a grid of LEDs. This project combines the basics of embedded programming, game....

Error based SQL Injection
Apr 26 Web App Hacking

In the previous example, we saw how a classic [SQL Injection Login Bypass](https://hacksland.net/sql-injection-login-bypass) works. SQL Injection is not all about that. The real fun is we can extract....

Assembly programming for beginners
Mar 23 Linux exploits

Assembly is a low-level programming language. You already know that low-level programming languages are close to machines and very hard to understand by humans. We have already written some programs....

GDB reverse engineering tutorial
Mar 23 Web App Hacking

hiii, I selected an interesting topic to discuss. Here, we are going to disassemble a binary file and take a look at what it does. This process is called reverse engineering. Let's run the program....