nerdexam
EC-Council

312-50V13 · Question #254

Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following…

The correct answer is D. select * from Users where UserName = 'attack' or 1=1 --' and UserPassword = '123456'. The correct SQL injection payload typically involves closing the current string, injecting a true condition (like or 1=1), and then using -- to comment out the remaining original query structure.

Submitted by dimitri_ru· Mar 6, 2026SQL Injection

Question

Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following credentials: Based on the above credentials, which of the following SQL commands are you expecting to be executed by the server, if there is indeed an SQL injection vulnerability?

Options

  • Aselect * from Users where UserName = 'attack'' or 1=1 -- and UserPassword = '123456'
  • Bselect * from Users where UserName = 'attack' or 1=1 -- and UserPassword = '123456'
  • Cselect * from Users where UserName = 'attack or 1=1 -- and UserPassword = '123456'
  • Dselect * from Users where UserName = 'attack' or 1=1 --' and UserPassword = '123456'

How the community answered

(30 responses)
  • A
    17% (5)
  • B
    33% (10)
  • C
    7% (2)
  • D
    43% (13)

Why each option

The correct SQL injection payload typically involves closing the current string, injecting a true condition (like `or 1=1`), and then using `--` to comment out the remaining original query structure.

Aselect * from Users where UserName = 'attack'' or 1=1 -- and UserPassword = '123456'

This option contains `UserName = 'attack''`, which has an extra single quote that would likely cause a SQL syntax error, rather than successful injection.

Bselect * from Users where UserName = 'attack' or 1=1 -- and UserPassword = '123456'

This option lacks the single quote after `attack` to properly close the string literal, making the `or 1=1` part a syntax error or part of the string, rather than an executable condition.

Cselect * from Users where UserName = 'attack or 1=1 -- and UserPassword = '123456'

This option integrates `or 1=1 --` directly into the string `UserName = 'attack or 1=1 --'`, treating it as part of the username itself, which would prevent the injection from executing as a SQL command.

Dselect * from Users where UserName = 'attack' or 1=1 --' and UserPassword = '123456'Correct

A classic SQL injection payload for authentication bypass aims to make the WHERE clause always true and invalidate the rest of the query. The input `attack' or 1=1 --` would transform an original query `SELECT * FROM Users WHERE UserName = '[input_username]' AND UserPassword = '[input_password]'` into `SELECT * FROM Users WHERE UserName = 'attack' or 1=1 --' AND UserPassword = '123456'`. The single quote closes the `UserName` parameter string, `or 1=1` creates an always-true condition, and `--` (two hyphens for SQL Server) comments out the subsequent original SQL code, effectively bypassing the password check and granting access.

Concept tested: SQL injection authentication bypass

Source: https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/06-Testing_for_SQL_Injection.html

Topics

#SQL injection#SQL syntax#comment injection#database queries

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V13 Practice