WEB-03 · Web Security

The Quotation Mark

A simulated staff login builds its query by pasting your username straight into the text.

Staff Login

internal tools · authorized staff only

This login builds its database query by pasting your username straight into the text of the query. Get in without knowing a password.

The query this form runs (simulated)

SELECT * FROM staff WHERE user = '' AND pass = ''

How to solve

You don’t know the password, so don’t try to guess it.
In the Username field, close the string with a quote and add a condition that is always true.
A classic payload is ' OR '1'='1' --. Put anything in the password field.
Watch the simulated query update, log in as admin, and grab the flag.

Lab details

Category: Web Security
Flaw: SQL injection
Difficulty: Medium
Fix: Prepared statements

This is a self-contained simulation for learning. The “server”, “database”, and “query” are all mocked in this page’s JavaScript. Nothing here connects to a real system.