MySQL “where 1=1”语句
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/8149142/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
"where 1=1" statement
提问by Mellon
Possible Duplicate:
Why would someone use WHERE 1=1 AND <conditions> in a SQL clause?
I saw some people use a statement to query a table in a MySQL database like the following:
我看到有人用语句来查询 MySQL 数据库中的表，如下所示：
select * from car_table where 1=1 and value="TOYOTA"
But what does 1=1mean here?
但1=1这里是什么意思？
回答by gbn
It's usually when folks build up SQL statements.
通常是在人们构建 SQL 语句时。
When you add and value = "Toyota"you don't have to worry about whether there is a condition before or just WHERE. The optimiser should ignore it
添加时and value = "Toyota"您不必担心是否有条件 before 或只是 WHERE。优化器应该忽略它
No magic, just practical
没有魔法，只有实用
Example Code:
示例代码：
commandText = "select * from car_table where 1=1";
if (modelYear <> 0) commandText += " and year="+modelYear
if (manufacturer <> "") commandText += " and value="+QuotedStr(manufacturer)
if (color <> "") commandText += " and color="+QuotedStr(color)
if (california) commandText += " and hasCatalytic=1"
Otherwise you would have to have a complicated set of logic:
否则，您将不得不拥有一组复杂的逻辑：
commandText = "select * from car_table"
whereClause = "";
if (modelYear <> 0)
{
if (whereClause <> "")
whereClause = whereClause + " and ";
commandText += "year="+modelYear;
}
if (manufacturer <> "")
{
if (whereClause <> "")
whereClause = whereClause + " and ";
commandText += "value="+QuotedStr(manufacturer)
}
if (color <> "")
{
if (whereClause <> "")
whereClause = whereClause + " and ";
commandText += "color="+QuotedStr(color)
}
if (california)
{
if (whereClause <> "")
whereClause = whereClause + " and ";
commandText += "hasCatalytic=1"
}
if (whereClause <> "")
commandText = commandText + "WHERE "+whereClause;
回答by Rubens Farias
If that query is being built dynamically, original author probably doesn't want to consider an empty set of conditions, so ends with something like this:
如果该查询是动态构建的，原作者可能不想考虑一组空的条件，所以以这样的方式结束：
sql = "select * from car_table where 1=1"
for each condition in condition_set
sql = sql + " and " + condition.field + " = " + condition.value
end
回答by Jon Egerton
1=1will always be true, so the value="TOYOTA"bit is the important one.
1=1永远是真的，所以这value="TOYOTA"一点很重要。
You get this in a few scenarios including:
您可以在以下几种情况下获得此信息：
Generated SQL: It's easier to create a generate a complex wherestatement if you don't have to work out if you're adding the first condition or not, so often a 1=1is put at the beginning, and all other conditions can be appended with an And
生成的 SQL：where如果您不必计算是否添加第一个条件，那么创建一个复杂的语句会更容易，所以通常 a1=1放在开头，所有其他条件都可以附加一个And
Debugging: Sometimes you see people put in a 1=1at the top of a where condition as it enables them to freely chop and change the rest of the conditions when debugging a query. e.g.
调试：有时您会看到人们在1=1where 条件的顶部放置一个，因为它使他们能够在调试查询时自由地切割和更改其余条件。例如
select * from car_table
where 1=1
--and value="TOYOTA"
AND color="BLUE"
--AND wheels=4
It has to be said that it isn't particularly good practice and normally shouldn't occur in production code. It may even not help the optimization of the query very much.
必须说这不是特别好的做法，通常不应该出现在生产代码中。它甚至可能对查询的优化没有很大帮助。
回答by Jeff Foster
As well as all the other answers, it's a simple technique for SQL injection attacks. If you add a OR where 1=1statement to some SQL then it's going to return all the results due to the inherent truthiness of the expression.
与所有其他答案一样，这是SQL 注入攻击的一种简单技术。如果您OR where 1=1向某些 SQL添加一条语句，那么由于表达式的固有真实性，它将返回所有结果。
回答by Udo Held
Its just an always true expression. Some people use it as an work-around.
它只是一个永远真实的表达。有些人将其用作解决方法。
They have a static statement like:
他们有一个静态语句，如：
select * from car_table where 1=1
So they can now add something to the where clause with
所以他们现在可以在 where 子句中添加一些东西
and someother filter
回答by Mohammed Shannaq
the 1=1 where condition is always true because always 1 is equal 1 , so this statement will be always true. While it means nothing sometimes. but other times developers uses this when the where condition is generated dynamically.
1=1 条件始终为真，因为始终 1 等于 1 ，因此该语句将始终为真。虽然它有时没有任何意义。但有时开发人员会在动态生成 where 条件时使用它。
for example lets see this code
例如让我们看看这个代码
<?php
//not that this is just example
//do not use it like that in real environment because it security issue.
$cond = $_REQUEST['cond'];
if ($cond == "age"){
$wherecond = " age > 18";
}
$query = "select * from some_table where $wherecond";
?>
so in the above example if the $_REQUEST['cond']is not "age" the query will return mysql error because there are nothing after the where condition.
所以在上面的例子中，如果$_REQUEST['cond']不是“ age”，查询将返回 mysql 错误，因为在 where 条件之后没有任何内容。
the query will be select * from some_table whereand that is error
查询将是select * from some_table where那是错误
to fix this issue (at least in this insecure example) we use
为了解决这个问题（至少在这个不安全的例子中），我们使用
<?php
//not that this is just example
//do not use it like that in real environment because it security issue.
$cond = $_REQUEST['cond'];
if ($cond == "age"){
$wherecond = " age > 18";
} else {
$wherecond = " 1=1";
}
$query = "select * from some_table where $wherecond";
?>
so now if the $_REQUEST['cond']is not agethe $wherecond will be 1=1 so the query will not have mysql error return.
所以现在如果$_REQUEST['cond']不是年龄$wherecond 将是 1=1 所以查询不会有 mysql 错误返回。
the query will be select * from some_table where 1=1and that avoid the mysql error
查询将是select * from some_table where 1=1并且避免了 mysql 错误
hope you understand when we use 1=1 while note that the above example is not real world example and it just to show you the idea.
希望您能理解我们何时使用 1=1，但请注意，上面的示例不是现实世界中的示例，只是为了向您展示这个想法。
回答by Farhan Alam
Most of time developer use these type of query if he is developing a query builder type application or building some complex SQL query so along with the select statement string add a conditional clause Where 1=1, and in program no need to add any check for it.
大多数时候，如果开发人员正在开发查询构建器类型的应用程序或构建一些复杂的 SQL 查询，那么开发人员会使用这些类型的查询，因此与 select 语句字符串一起添加条件子句 Where 1=1，并且在程序中无需添加任何检查它。
回答by toon81
The query finds all rows for which 1 equals 1 and value equals 'TOYOTA'. So in this case it's useless, but if you omit a WHERE statement, it can be a good idea to use WHERE 1=1 to remind you that you chose NOT to use a WHERE clause.
该查询查找 1 等于 1 且值等于 'TOYOTA' 的所有行。所以在这种情况下它是没有用的，但是如果你省略了 WHERE 语句，使用 WHERE 1=1 来提醒你你选择了 NOT 使用 WHERE 子句可能是个好主意。
回答by Nighil
the use of this comes in complex queries when passing conditions dynamically,You can concatenate conditions using an " AND " string. Then, instead of counting the number of conditions you're passing in, you place a "WHERE 1=1" at the end of your stock SQL statement and throw on the concatenated conditions.
当动态传递条件时，在复杂的查询中使用 this，您可以使用“AND”字符串连接条件。然后，不是计算您传入的条件数，而是在您的库存 SQL 语句的末尾放置一个“WHERE 1=1”并抛出连接的条件。
no need to use 1=1 you can use 0=0 2=2,3=3,5=5 25=25 ......
不需要使用 1=1 你可以使用 0=0 2=2,3=3,5=5 25=25 ......
select * from car_table where 0=0 and value="TOYOTA"
here also you will get the same result like 1=1 condition
在这里，您也会得到与 1=1 条件相同的结果
because all these case is always true expression
因为所有这些情况总是真实的表达
1=1 is alias for true
回答by BobbyGoks
i did this when i need to apply the filters dynamically.
like, while coding i dunno how many filter user will apply (fld1 = val1 and fld2=val2 and ...)
so, to repeat the statement "and fld = val" i start with "1 = 1".
hence, i need not trim the first "and " in the statement.
当我需要动态应用过滤器时，我这样做了。
就像，在编码时我不知道有多少过滤器用户将应用（fld1 = val1 和 fld2=val2 和...）
所以，重复语句“and fld = val”我以“1 = 1”开头。
因此，我不需要修剪语句中的第一个“和”。
