Bypass Website Login By SQL Injection Hack !

Suppose, a site has a login form and only the registered users are allowed to enter the site. Now, say u wanted to bypass the login and enter the site as the legitimate user. If the login scriptblock is not properly sanitized by the programmer, u may have luck to enter the site. U might be able to login into the site without knowing the real username and real password by just interacting with the DB server. So, isn’t that the beauty of " SQL injection " ??

Let’s see an example, where the username admin with the password pass123 can login to the site.
Suppose, the SQL query for this is carried out as below:


SELECT USER from database WHERE username=’admin’ AND password=’pass123′


And if above SELECT command evaluates true, user will be given access to the site otherwise not. Think what we could do if the scriptblock is not sanitized. This opens a door for the hackers to gain illegal access to the site.
In this example, the attacker can enter the following user data in the login form:


username: a or 1=1–


password:blank


So, this would make our query as:


SELECT USER from database WHERE username=’a’ or 1=1– AND password=”

Note :- In Previous post on " SQL Injection " Theirs given a link have 6 K vurnabelar sites

Note that — is the comment operator and anything after it will be ignored as a comment. There exists another comment operator which is /*.


So our above query becomes:


SELECT USER from database WHERE username=’a’ or 1=1
Now this query evaluates true even if there is no user called ‘a’ bcoz 1=1 is always true and using OR makes the query return true when one of the query is true. And this gives access to the site admin panel.

There can be various other username and password combinations to play with the vulnerable sites. U can create ur own new combinations for the site login.

Few such combinations are:

username:’ or 1=’1 password:’ or 1=’1

username:’ or ’1′=’1′ password:’ or ’1′=’1′

username:or 1=1 password:or 1=1

and there are many more cheat sheets. Just google. In fact, you can create your own such combination to bypass logins..

That’s all about bypassing logins.

Enjoy this Website Hack And Do not Forget To Comment

Search Keywords:-

sql injection tutorial , sql injection cheat sheet ,sql injection attacks ,what is sql injection ,blind sql injection ,sql injection hack , sql injection strings , sql injection examples , sql server injection , test sql injection , sql injection code , sql injection vulnerabilities ,advanced sql injection ,sql injection exploit ,how to sql injection ,hack website , how to hack website , hacking website , hack website instantly