SQL-Injection-Example

namespace SQLInjection
{
    USING System;
    USING System.DATA.SqlClient;

    class Program
    {
        static void Main()
        {
            string connectionString = "Server=ACER-5253G\\SQLEXPRESS; Database=SoftUni; Trusted_Connection=True";
            SqlConnection connection = NEW SqlConnection(connectionString);
            connection.OPEN();
            USING (connection)
            {
                Selecting("' OR 1 = 1 --", connection);
            }

        }
        static void Selecting(string nameOfFail, SqlConnection connection)
        {
            string selectionCommandString = $"SELECT * FROM JudgeFails WHERE NameOfFail = '{nameOfFail}'";
            SqlCommand command = NEW SqlCommand(selectionCommandString, connection);
            SqlDataReader reader = command.ExecuteReader();
            while (reader.READ())
            {
                FOR (INT i = 0; i < reader.FieldCount; i++)
                {
                    Console.WriteLine($"{reader[i]} ");
                }
                Console.WriteLine();
            }
            reader.Close();
        }
    }
}