When and why you should use 1=1 in WHERE clause?

This will select all records from the mentioned table. Usually used in SQL injection to retrieve all data from Table.

Avikshith Aradhya10y

when we want to retrieve all record of a table..........

Pankaj Kumar Choudhary11y

I some time use 1=1 for checking sql injection attack possibilty

Vithal Wadje12y

When ever you want to build or create dynamic SQL and when you writing condition but you do not know whether your dynamic query has where clause or not. Use where 1=1 to make sure your dynamic query has where clause

Jignesh Trivedi12y

it shows the all records from table

Vithal Wadje12y

If you don't know the list of conditions at compile time and it will built at run time, Then you can made a condition with “where 1=1”. and for other conditions that will affect run time, use

and .

StringBuilder sb = new StringBuilder();
sb.Append("SELECT * FROM Products"); // Your query
sb.Append(" WHERE 1=1"); // always true condition
// append query's where clause
if (catID != 0)
{
sb.Append(" AND categoryID= {0}", catID);
}
if (minPrice > 0)
{
sb.Append(" AND itemPrice >= {0}", minPrice);
}
SqlCommand cmd = new SqlCommand(sb.ToString(), cnn);
SqlDataReader dr = cmd.ExecuteReader();
// your code to read data from dr.

Uma Shankar Patel12y

When and why you should use 1=1 in WHERE clause?

6 Answers