-1" OR 5*5=26 --

That looks like a partial SQL injection payload rather than a math expression.

What it’s trying to illustrate (at a high level)

• It attempts to terminate an existing string literal in a query and inject additional SQL.
• The injected part typically adds an OR condition (here, 5*5=26) and then uses a comment marker (--) to ignore the rest of the original query.
• Depending on the database, -1 may be treated as true (nonzero) and 5*5=26 is false, but with OR the condition can become true, potentially bypassing checks. The exact effect depends on the DB engine and how the input is incorporated.

Key point for exams

• This demonstrates why dynamic string concatenation for SQL queries is dangerous and should be avoided.
• The safe defense is to use parameterized queries (prepared statements) so user input cannot alter the SQL structure.

Defensive practices

• Use prepared statements with placeholders (no string concatenation of user input).
• Validate and constrain input (allow lists, length checks).
• Use a least-privilege database account.
• Prefer ORM/query builders that separate code from SQL.
• Disable or properly handle error messages to avoid exposing DB details.

Safe example (parameterized query)

• Python (SQLite example)

  • query = "SELECT * FROM users WHERE username = ? AND password = ?"
  • cursor.execute(query, (username_input, password_input))

• Java (JDBC)

  • String sql = "SELECT * FROM users WHERE username = ?";
  • PreparedStatement ps = conn.prepareStatement(sql);
  • ps.setString(1, username_input);
  • ResultSet rs = ps.executeQuery();

If you’re studying for exams, I can tailor explanations to your specific DB ( MySQL, PostgreSQL, SQLite ) and walk through how parameterization prevents this kind of injection, plus give you practice questions. Do you want that?