💉 02 — SQL Injection

Easy Medium Hard
Easy Medium Hard
0/3 solved

🔑 Easy — Authentication Bypass

The login form uses raw string interpolation in SQL. Bypass authentication without knowing the password.

Try admin' OR '1'='1 as username and anything as password. The query becomes SELECT * FROM users WHERE username='admin' OR '1'='1' AND password='anything'