-1' OR 3*2>999 --

This looks like a fragment of an SQL injection payload. It’s not a valid standalone expression, but it’s meant to be injected into an SQL query to alter its logic.

What the pieces mean:

• -1' attempts to close a prior string literal in the SQL query (the quote ends a string begun earlier).
• OR introduces an alternate condition.
• 3*2>999 is a boolean comparison; it evaluates to false (6 > 999 is false).
• -- starts a comment in many SQL dialects, so the rest of the line is ignored.

Truth value:

• 3*2>999 evaluates to false.
• So the injected part effectively contributes OR false, which in boolean logic doesn’t help the attacker unless the left-hand side (the part before OR) makes the overall condition true. In many cases this particular payload would either:
  • cause a syntax error due to the mismatched quote, or
  • have little or no effect if the surrounding query requires the left-hand side to be true.

A more common (and more dangerous) payload is something like ' OR 1=1 --, which makes the condition always true.

Defenses (important for exams and real systems):

• Use parameterized queries (prepared statements) so user input is never treated as part of the SQL syntax.
• Validate and sanitize inputs; enforce type and length constraints.
• Use least-privilege database accounts (no rights beyond what’s needed).
• Disable multiple-statement executions if your environment allows it.
• Prefer ORM or query builders that handle escaping automatically.
• Regularly test for SQL injection using safe, controlled lab environments and security tooling.

If you’re studying for an exam, focus on understanding:

• how closing quotes and comments can be used in injections,
• why 3*2>999 is false,
• and how parameterization prevents these tricks from altering query logic.