Simple SQL injection

Today i'm going to explain SQl injection.

For some sites (and no, not any secure sites like Gmail or Facebook) that ask for a user name and password, they sometimes tend to verify the password through SQL.

Well here's a method to bypass, or in other words trick the SQL engine into thinking you've typed the correct password.

Simply type the user name, and for the password type

'or'1'='1

yes, that mathematical equation should work on all SQL verifiable sites.

HOW IT WORKS

Well imagine a password box.
Suppose you password was hello.
When it is read by the SQL engine its stored as 'hello'.
Do you see the 2 addition quotes?

Now lets take "our" password.
'or'1'='1

Now see what happens when the SQl engine reads it.
Its stored as ''or'1'='1'
The first 2 quotes cancel each other out, so
or'1'='1'
So by adding this statement to the end of an SQL query it checks whether the query is true through an OR statement.
Obviously '1' is equal '1', so the SQL engine thinks we've entered the correct password by simply adding an OR statement to the end of the query.

Note: This wont work for many sites, as security has been improved. However there are other sites online which can be hacked into using this technique.
This is merely meant for educational purposes only. I haven't added screenshots of the sites that can be hacked for obvious reasons.

If you liked this post please share, and give it a +1.
I'll be sure to post more soon.