SQL Injection

a good way of testing web site login forms for their prevention of sql injection is to enter the following as the user name and password.

hi' or 1 = 1

this would change any select query to the following when details are submitted:


select * from sql where loginid='hi' or 1=1

so in essence it will always return a result and you can get access to the site.

thats if the site has poor security and doesn't cater for sql injection.