Arnold is trying to gain access to a database by inserting exploited query statements with a WHERE clause. He wants to retrieve all the entries from a particular table (e. g. StudName) using the WHERE clause. What query does Arnold need to write to retrieve the information?

Question

Quizplus · Accepted Answer

The correct query is: SELECT * FROM StudName WHERE roll_number = " or '1' = '1'This query uses SQL injection to bypass the WHERE clause and retrieve all the entries from the StudName table. The " or '1' = '1'" part of the query is a SQL injection payload that evaluates to true, regardless of the value of the roll_number column. This allows Arnold to retrieve all the entries from the table, even if he does not know the roll number of any specific student.

Arnold Is Trying to Gain Access to a Database by Inserting