试试看SQL注入吧！ 如果这个用户名密码验证的SQL语句为strSql = “SELECT *FROM tbl WHERE username=’” + username.text + “‘ AND password=’” + password.text + “‘”; 那么假设在用户名文本框里输入　’ or 1=1–　，那么SQL语句变为SELECT * FROM tbl WHERE username=” or 1=1– AND password=” 尽管username为空串，但是和1=1这个恒真的等式或运算以后，SELECT后的结果就是表里所有的数据，而1=1后面的–把后面的AND password=”注释掉了，如果程序里面再判断只要结果不为空即登录成功的话…嘿嘿～ Mission 2 complete!

This is the last part of the solutions of hackthissite.org Basic Missions. Have in your mind that you must try as hard as you can to pass the test without any help. If you get stuck, try reading the hints in the HTS Forums. Make sure the following post is your very last resort. Basic … More Hack This Site: Basic Missions #8-11