title: SQL Injection Exploiting Login form
body: <p>I was wondering while testing my website that is there any way that the user can fetch data from my database by making some further modification in the following query</p>
  
  <pre><code>SELECT * FROM users WHERE login='admin' AND password='1' OR '1'='1';
  </code></pre>
  
  <p>provided that he knew <code>admin</code> username and used <code>'1'='1'</code> for password to hack into it.</p>
  
  <p>What else can he add to echo the password on screen or find table details?</p>
  
  <p>I want to do this to understand the limits the unprotected <code>SQL</code> can harm us for my presentation on SQL injection</p>