The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

particular, modifying the 

WHERE

clause in an 

UPDATE

statement can cause

changes to be made throughout a critical table of the database. For example, if

the attack just described had instead supplied the username

admin’ or 1=1--

then this would cause the application to execute the query

UPDATE users SET password=’newsecret’ WHERE user = ‘admin’ or 1=1

which resets the value of every user’s password!

Be aware that this risk exists even when you are attacking an application

function that does not appear to update any existing data, such as the main

login. There have been cases where following a successful login the application

performs various 

UPDATE

queries using the supplied username, meaning that