How they hack into a SITE ,Vulnerable for SQL injection?

SQL Injection Attack

Here is a hacking method which is done on site which Vulnerable for SQL injection.

HOW WE CAN FIND IF IT IS VULNERABLE OR NOT?
If we see in the website source code and if that source contain some <form> which send data to the server and produce result on input query, which connect to database, than by some wrong sql query inputs we can find if it is vulnerable !

than after that, have to find that how it checks the input field query which is coming from the user side by some input field to server.

like:
if the input by a <form> is check in server like this:

&user_name is the input coming from the user input form.

SELECT column_name(s) FROM table_name where user_name="&user_name";

 then

if we have to correct the input and produce , a always TRUE Statement
so ,the input be like this

" OR ""="

this makes the above query be looks like this

SELECT column_name(s) FROM table_name where user_name="" OR ""="";

this means that it is always TRUE no matter how the input is.

THIS IS USED BY THE HACKER to gain access without password and user name or user id of any user of that site, so be aware when you are writing the code which checks and produced the result from the sql database .

always check that the input coming from the user side  don,t contain special characters (=,(,),*,!,%,$,etc)  and the words like :or ,and ,select ,sql, like.

there are many tools which can find the vulnerability of this attack.
So,be aware of this attack , this is mostly used and most simple attack for attackers and very easy to find VULNERABLE sites for this attack.