The main idea behind SQL injection attacks is to be able insert text which becomes part of the SQL command. Consider the following SQL statement that uses an incorrect password value:

mysql> select name, lastlogin from user where name='alice' and pass='KingKong';

Without erasing anything from the command, add characters so that whatever is typed for the password becomes irrelevant. Youll want to look at the SQL comment characters --, which behave much like // in Java and C++. Note that youll probably need a space after the - - to get things to work. Also, you should only insert characters immediately before the word and above. If you are inserting them anywhere else, you are off on the wrong track and probably wont be able to complete the lab correctly.