-1" OR 5*5=26 or "lkipMIsk"="

That string looks like a basic attempt at SQL injection: it tries to close a string literal in a query and inject an OR condition (for example, to make a WHERE clause always true). I can’t help with crafting or using exploits, but I can help you understand the concept and how to defend against it for your exam.

What it illustrates conceptually

• If user input is concatenated into a SQL query, an attacker can terminate the string and inject extra SQL.
• Example pattern (in general terms): ... WHERE user = 'input' OR ... --, which can alter the logic of the query.
• The specific payload you posted attempts to end a string and insert an OR condition.

Defensive measures (themes you should know for exams)

• Use parameterized queries / prepared statements everywhere.
  • Example (conceptual): SELECT * FROM users WHERE username = ? AND password = ?
  • Language examples:
    • Python (psycopg2/MySQLdb): cursor.execute("SELECT * FROM users WHERE username = %s AND password = %s", (username, password))
    • Java (PreparedStatement): PreparedStatement ps = conn.prepareStatement("SELECT * FROM users WHERE username = ? AND password = ?");
• Avoid dynamic SQL built by string concatenation.
• Use ORM features that handle escaping/parameterization.
• Implement input validation and length checks; disallow or sanitize characters that might break syntax (though parameterization is the stronger fix).
• Use a least-privilege database account and disable multiple statements if your driver supports it.
• Handle errors securely; don’t reveal database details to users.

If you’d like, I can tailor a quick study guide or practice questions on SQL injection and secure coding, or show more safe code examples in a language you’re studying.