mySQL returns all rows when field=0

I was making some tests, and it was a surprise when i was querying a table, and the query SELECT * FROM table WHERE email=0 returned all rows from the table.

This table has no '0' values and it's populated with regular e-mails.

Why this happens? This can lead to serious security problems.

Is there a way to avoid this without modifying the query?

Am i missing something here?

Thanks.

This is because it is converting the email field (which I assume is a varchar field) to an integer. Any field without a valid integer will equate to 0. You should make sure that you only compare string fields to string values (same goes for dates, comparing to dates). The query should be as follows.

SELECT * FROM table WHERE email='0';

Your email column is a CHAR or VARCHAR type. When you use the condition email = 0, MySQL is casting the contents of the email column to an integer in order to compare them with the 0 you supplied. Had you surrounded your 0 in quotes, the query would work as expected. (email = '0')

Converting a non-numeric string to an integer in MySQL will result in 0.

mysql> SELECT CAST('[email protected]' AS SIGNED);
+-------------------------------------+
| CAST('[email protected]' AS SIGNED) |
+-------------------------------------+
|                                   0 |
+-------------------------------------+

In contrast, if you attempted the same thing with numeric strings, they may cast correctly:

mysql> SELECT CAST('12345' AS SIGNED);
+-------------------------+
| CAST('12345' AS SIGNED) |
+-------------------------+
|                   12345 |
+-------------------------+

The email field is probably characters and you are matching numeric values.

Try with,

SELECT * FROM table WHERE email='0';