5

I have a sql injection vulnerable site which works well if i input query like this qq' -- // or qq' -- ; . But when i inject without slash or semi-colon it throws following error "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '--%'' at line 1"

So what is the use of slash or semi-colon in the query, please explain the scenario.

3
  • Thanks. So in the query what is the use of double dashes (--) . or double dashes need to ended with // or ; .
    – Gowtham
    Oct 16, 2015 at 16:21
  • -- is a decrementing operator. if used on a variable if can do one of two things. --a would decrement a by 1 and then return the value. a-- would return the value of a and the decrement it by one. I would imagine that you are creating an instance of -1 possibly which could also translate to a bool value of true. Have you tried 'or 1=1';//
    – David-
    Oct 16, 2015 at 16:28
  • @David- That's false. It's a comment delimiter and has nothing to do with decrementing.
    – Arminius
    Apr 18, 2016 at 0:46

2 Answers 2

1

MySQL’s comment syntax requires a whitespace or control character after the --:

From a “-- ” sequence to the end of the line. In MySQL, the “-- ” (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax, as discussed in Section 1.7.2.4, “'--' as the Start of a Comment”.

The additionally included character in your cases probably just prevents the removal of the trailing whitespace or control character required by MySQL.

0

// is a way to comment out a line in PHP and possibly other languages, so it would make sense that you may be causing the rest of the query to be ignored. as far as the semicolon is to tell it the line is finished. If its a multi-line code you are making it comment out the rest and tell it to execute the line up to the semicolon.

you may want to try your injection before the // and end it with ;

Additionally, depending on how the query was run you may be able to write your own additional query's by separating them with ;

1
  • 2
    What would PHP code that would take a comment delimiter in a variable look like? Do you think they have a call to eval for the database access? If they do, that would be a lovely PHP injection vulnerability. Oct 16, 2015 at 19:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .