6
Reply

When and why you should use 1=1 in WHERE clause?

Uma Shankar Patel

Uma Shankar Patel
11y
3.4k
0
Reply
    Jignesh Trivedi
    When ever you want to build or create dynamic SQL and when you writing condition but you do not know whether your dynamic query has where clause or not. Use where 1=1 to make sure your dynamic query has where clause
    Jignesh Trivedi
    11y
    1
    Avikshith Aradhya
    This will select all records from the mentioned table. Usually used in SQL injection to retrieve all data from Table.
    Avikshith Aradhya
    9y
    0
    Pankaj Kumar Choudhary
    when we want to retrieve all record of a table..........
    Pankaj Kumar Choudhary
    10y
    0
    Vithal Wadje
    I some time use 1=1 for checking sql injection attack possibilty
    Vithal Wadje
    11y
    0
    Vithal Wadje
    it shows the all records from table
    Vithal Wadje
    11y
    0
    Uma Shankar Patel
    If you don't know  the list of conditions at compile time and it will built at run time, Then you can made a condition with “where 1=1”. and for other conditions that will affect run time, use
    and .

    1. StringBuilder sb = new StringBuilder();  
    2.          sb.Append("SELECT * FROM Products");  // Your query  
    3.          sb.Append(" WHERE 1=1"); // always true condition  
    5.          // append query's where clause  
    7.          if (catID != 0)  
    8.          {  
    9.              sb.Append(" AND categoryID= {0}", catID);  
    10.          }  
    11.          if (minPrice > 0)  
    12.          {  
    13.              sb.Append(" AND itemPrice >= {0}", minPrice);  
    14.          }  
    16.          SqlCommand cmd = new SqlCommand(sb.ToString(), cnn);  
    17.          SqlDataReader dr = cmd.ExecuteReader();  
    18.          // your code to read data from dr.  
    Uma Shankar Patel
    11y
    0
Message