title: 40' OR '1'='1 this is prone to sql injection?
body: <p>I have developed a simple application for study of sql injection where i search for rate &lt; 40 and retrive all the names having rate less than 40 but when i pass search as <strong>40' OR '1'='1</strong>
  so it retrieves all the records from database table 
  I know how to solve this problem but i don't know <strong>40' OR '1'='1</strong> how this statement works when i pass <strong>40' OR '1'='1</strong> can any one briefly tell me what happens when i pass <strong>40' OR '1'='1</strong> in search box ??</p>
  
  <p>hoping for quick and positive response ...</p>
  
  <pre><code>&lt;?php
  include("conn.php");
  
  $get_rate = $_GET['rate'];
  
  $query = "select * from `sqlinjection`.`products` WHERE `products`.`rate` &lt; '".$get_rate."'";
  
  
  $result=mysql_query($query);
  
  if($result == false)
  {
      die(mysql_error());
  
  }
  
  while($row=mysql_fetch_array($result))
  {
  
  echo "Name".$row['srno']."&lt;br/&gt;";
  echo "Name".$row['name']."&lt;br/&gt;";
  echo "Rate".$row['rate']."&lt;br/&gt;";
  }
  
  ?&gt;
  </code></pre>