During a penetration test, the tester enters ' OR 1=1 -- into the username field of a web application's login form and leaves the password blank. The application logs the tester in and displays every user record stored in the backend database. Which attack has succeeded?

SQL injection occurs when user-supplied input is concatenated into a database query without proper parameterization, allowing the input to change the query's logic. The string shown closes the expected text value with a quote, appends a condition that always evaluates to true, and uses a comment marker to discard the remainder of the original statement, including any password check. The database therefore returns all rows and the application treats the request as authenticated. Cross-site scripting injects script into pages that are rendered in another user's browser; its payloads target the browser rather than altering a backend query, and it would not return database records on login. Directory traversal uses sequences such as dot-dot-slash to read files outside the web root, which is a file system attack, not a query manipulation. A buffer overflow writes more data than a memory buffer can hold to corrupt adjacent memory or redirect execution; a short logical string like this one does not exceed buffer limits. Exam caveat: the presence of quotes, Boolean logic, and comment syntax in an input field is the hallmark that distinguishes injection from other application attacks. Operational check: confirm the application uses parameterized queries or prepared statements, apply server-side input validation, and review database logs for similar tautology patterns.