Ravindra BagaleCourses & study guides

10. MySQL Part 1: Install, Create, Insert and SELECT

10.5 SELECT Basics and WHERE

By Last updated:

SELECT mhanje prashna vicharne. WHERE mhanje filter – kontya rows pahijet.

SELECT * FROM students;                              -- all columns (avoid in apps)
SELECT name, city FROM students;                     -- chosen columns
SELECT name, fees_paid FROM students WHERE city = 'Pune';
SELECT name, age FROM students WHERE age > 25;
SELECT name FROM students WHERE city = 'Nagpur' AND fees_paid >= 10000;
SELECT name FROM students WHERE city = 'Pune' OR city = 'Nashik';
SELECT name FROM students WHERE NOT city = 'Pune';
SELECT name FROM students WHERE city <> 'Pune';      -- same as above
Operator Meaning
=, <> or != Equal, not equal
>, <, >=, <= Comparisons
AND, OR, NOT Combine conditions (use brackets to be clear)

Sample output of SELECT name, fees_paid FROM students WHERE city = 'Pune';

name fees_paid
Ravindra Bagale 15000.00
Shraddha Bagale 15000.00
Rani 15000.00

Why this matters for security

The classic injection ' OR '1'='1 works because OR with an always-true condition makes the WHERE clause match every row – for a login query, that means "logged in without a password". Once you understand WHERE, you understand why that payload works.

Ravindra Bagale's Tip

If you use AND and OR together without brackets, you get the wrong rows – many students fall into this trap. AND is evaluated first. If in doubt, always use brackets: WHERE (city='Pune' OR city='Nashik') AND age > 25.

Practice task

Show students from Nagpur; students older than 24 who paid 15000; and students not from Pune – three separate queries.