MENU
Look at the following SQL query.
SELECT * FROM product WHERE PCategory='computers' or 1=1--'
What will it return? Choose the best answer.
Suggested Answer: C
Get Premium CPEH-001 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The 1=1 tells the SQL database to return everything, a simplified statement would be SELECT * FROM product WHERE 1=1 (which will always be true for all columns). Thus, this query will return all computers and everything else. The or 1=1 is a common test to see if a web application is vulnerable to a SQL attack.
25 comments · newest first
JO
Josefa
4 months ago
It's a common trick to bypass filters. Good to know!
DO
Dong
4 months ago
I feel confused. Why use "1=1"?
TW
Twana
4 months ago
Yeah, "1=1" makes it a valid query.
CL
Claribel
5 months ago
It will return all products. The condition is always true.
FE
Fernanda
6 months ago
Seems a bit risky to use that kind of query!
AL
Alexia
6 months ago
Yup, 1=1 makes it always true, so all rows are selected.
FR
Franchesca
6 months ago
Wait, really? I thought it would just return computers.
EV
Evan
6 months ago
Totally agree, that query is a classic SQL injection example.
BU
Buffy
6 months ago
It will return all products, not just computers.
AR
Arlie
6 months ago
This query is a security nightmare. I hope no one actually uses something like this in production.
PU
Pura
7 months ago
Haha, the '1=1--' part is a classic SQL injection trick! Gotta love those sneaky hackers.
ZO
Zona
7 months ago
The query is vulnerable to SQL injection, allowing an attacker to potentially access sensitive data.
JA
Jaime
7 months ago
This query will return all rows from the product table, regardless of the PCategory value.
BE
Becky
7 months ago
I feel like it might return only computers, but that "or 1=1" part is really throwing me off.
AL
Alana
7 months ago
This kind of question seems familiar; I practiced a similar one where the query returned all rows due to a similar condition.
SH
Sharen
8 months ago
I'm not entirely sure, but I remember something about how "1=1" can be used to bypass filters in SQL.
TY
Ty
8 months ago
I think this query will return all products because of the "or 1=1" condition, right?
KI
Kimberely
8 months ago
Yep, this is a classic example of a SQL injection vulnerability. I'll be sure to analyze any SQL queries carefully on the exam and look out for potential security issues like this.
DE
Denna
9 months ago
Got it, that makes sense. The '1=1' condition is a common technique used in SQL injection attacks to bypass security checks. I'll make sure to watch out for anything like that on the exam.
HO
Honey
9 months ago
Wait, what? The '1=1' part makes the whole 'or' condition always true. So it's going to return all rows from the 'product' table, regardless of the 'PCategory' value.
EL
Eliseo
9 months ago
Okay, let's see. The query is selecting all rows from the 'product' table where the 'PCategory' is 'computers' or the condition '1=1' is true. The '--' at the end is a comment, so it won't affect the query.
DA
Darci
9 months ago
Hmm, this looks like a tricky one. I'll need to think it through carefully.
MY
Myra
3 months ago
Exactly! It's a classic SQL injection example.
NA
Naomi
3 months ago
Yeah, because of the "or 1=1" part.
SH
Shannon
3 months ago
It will return all products.