“万能密码”SQL注入基本原理

<span style="font-size:14px;">string id = "'haha' + or 1=1 or 1=1",
string password = "'123'"(any password)
string sql = string.format("select * from users where id={0} and password={1}", id, password);
</span>

<span style="font-size:14px;">where id='haha' or 1=1 or 1=1 or password='123'
=> where id='haha' or 1=1 or false
=> where true
</span>