MySQL Injection With Apostrophe Question

[dman777]

I was reading the tutorial on hardening a php web server. In it they show an exploit with an SQL enjection:

[sebaro]

str1 = SELECT Username, Password FROM Users WHERE Username = '
str2 = ' OR 1=1 #
str3 = ' and Password = '
str4 =
str5 = '

str = SELECT Username, Password FROM Users WHERE Username = ' . ' OR 1=1 #' . and Password = ' . '
str = SELECT Username, Password FROM Users WHERE Username = ' ' OR 1=1 #' and Password = ''

Try it in a shell:
# user="' OR 1=1 #";pass="";echo "SELECT Username, Password, UserLevel FROM Users WHERE Username = '$user' and Password = '$pass'"

[athena810]

normally, for sql injection, it works with a form. like a username password form.