Why is a 0 value returning everything

ifubad

name column is set to CHAR with user names as data

The following will retrieve all rows, even though the value in numeric. which is not what I'm expecting

SELECT * FROM secret WHERE name=0

I'm assuming the 0 is stating false, but how is MySQL interpreting it and retrieving everything?

HalfaBee

What are you expecting?

If the column is text, search for text not numbers.

ifubad

I understand that all input should be validated and be as restrictive as possible. Just trying to understand a little bit more about injection, even as simple as the numeric 0

NogDog

http://dev.mysql.com/doc/refman/5.0/en/type-conversion.html

Weedpacket

ifubad wrote:
Just trying to understand a little bit more about injection, even as simple as the numeric 0

So put quotes around it and it wouldn't be numeric. An injection can't remove quotes that are already there. Note that other DBMSs would cast the 0 to '0' (since the column is a character type), instead of the other way around.

But PHP has for three years now had mechanisms in place that will do all the necessary quoting and escaping for you if you used them.