sql - Why does SELECT 'a'='b'='c' return 1 in MYSQL? -

i doing homework security class involving sql injections. found shorter sql injection typical ' or '1'=1 example. instead '='. typing in password field of typical login boxes gives sql query this:

select * users username='user' , password=''=''; 

it turns out password=''='' evaluates 1, allowing sql injection work.

after doing more testing, saw if test if string equal 0, returns 1:

select 0='a'; 

so in example, password='' evaluate 0 , 0='' end evaluating 1.

my testing showed me how happening, want know why happens (i.e why 0='a' true?.

as documented under type conversion in expression evaluation, comparisons between string , integer performed numerically:

• in other cases, arguments compared floating-point (real) numbers.

therefore, operands converted floating-point numbers , compared.

conversion of string float consider every numeric character (and first period or exponentiation character) encountered first non-numeric character. therefore 'hello' or 'a' truncated '' (and thereby cast zero) whereas '123.45e6foo789' truncate '123.45e6' (and thereby cast 123,450,000).

thus 1 can see how 0='a' true: compared 0=0.

that password=''='' true (provided that password non-empty string, or non-zero numeric) comes because first comparison results in 0 (false), forces second comparison performed numerically (thus converting '' 0 comparison 0 result of first comparison).