SQL语句:
<span style="font-size:14px;">string id = "'haha' + or 1=1 or 1=1",
string password = "'123'"(any password)
string sql = string.format("select * from users where id={0} and password={1}", id, password);
</span>
可以取出一个密码,并通过登录验证。
原理:
and 优先级大于or,
<span style="font-size:14px;">where id='haha' or 1=1 or 1=1 or password='123'
=> where id='haha' or 1=1 or false
=> where true
</span>