When and why you should use 1=1 in WHERE clause?

When ever you want to build or create dynamic SQL and when you writing condition but you do not know whether your dynamic query has where clause or not. Use where 1=1 to make sure your dynamic query has where clause

Jignesh Trivedi

10y

1

This will select all records from the mentioned table. Usually used in SQL injection to retrieve all data from Table.

Avikshith Aradhya

8y

0

when we want to retrieve all record of a table..........

Pankaj Kumar Choudhary

9y

0

I some time use 1=1 for checking sql injection attack possibilty

Vithal Wadje

10y

0

it shows the all records from table

Vithal Wadje

10y

0

If you don't know the list of conditions at compile time and it will built at run time, Then you can made a condition with “where 1=1”. and for other conditions that will affect run time, use

and .

StringBuilder sb = new StringBuilder();
sb.Append("SELECT * FROM Products"); // Your query
sb.Append(" WHERE 1=1"); // always true condition
// append query's where clause
if (catID != 0)
{
sb.Append(" AND categoryID= {0}", catID);
}
if (minPrice > 0)
{
sb.Append(" AND itemPrice >= {0}", minPrice);
}
SqlCommand cmd = new SqlCommand(sb.ToString(), cnn);
SqlDataReader dr = cmd.ExecuteReader();
// your code to read data from dr.

Uma Shankar Patel

10y

0