What SQL injection allows an attacker to try to alter the SQL statement such that it always return true or performs some function like delete or update?

Answer 1

SQL injection allows an attacker to manipulate a SQL query by injecting malicious code into input fields, enabling them to alter the intended query structure. This can lead to scenarios where conditions always evaluate to true, allowing unauthorized access or data manipulation, such as executing DELETE or UPDATE commands. For instance, by injecting a payload like OR '1'='1', an attacker can bypass authentication checks. This vulnerability highlights the importance of validating and sanitizing user inputs to protect against such attacks.