Because '1'='1' is always true, the database returns all rows for tom . The application logic sees a result and thinks the answer is correct.
Among its many lessons, the series is notorious for teaching business logic flaws and injection attacks. Specifically, "Password Reset 6" (often labeled as "Password Reset" lesson 6 or the advanced SQL injection variant) is where the training wheels come off. webgoat password reset 6