Tags: MySQL

For Number data type, MySQL parse String value character-by-character until it finds character other than number.

Queries

SELECT * FROM users WHERE id = '12 or 1=1'; \\ 1 -> OK, 2 -> OK,  -> false-and-return
> SELECT * FROM users WHERE id = 12;

SELECT * FROM users WHERE id = '123XYZ'; \\ 1 -> OK, 2 -> OK, 3 -> OK, X -> false-and-return
> SELECT * FROM users WHERE id = 123;

SELECT * FROM users WHERE id = '1&23XYZ'; \\ 1 -> OK, & -> false-and-return
> SELECT * FROM users WHERE id = 1'

Tags: MySQL