5

I have a sql injection vulnerable site which works well if i input query like this qq' -- // or qq' -- ; . But when i inject without slash or semi-colon it throws following error "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '--%'' at line 1"

So what is the use of slash or semi-colon in the query, please explain the scenario.

  • Thanks. So in the query what is the use of double dashes (--) . or double dashes need to ended with // or ; . – Gowtham Oct 16 '15 at 16:21
  • -- is a decrementing operator. if used on a variable if can do one of two things. --a would decrement a by 1 and then return the value. a-- would return the value of a and the decrement it by one. I would imagine that you are creating an instance of -1 possibly which could also translate to a bool value of true. Have you tried 'or 1=1';// – David- Oct 16 '15 at 16:28
  • @David- That's false. It's a comment delimiter and has nothing to do with decrementing. – Arminius Apr 18 '16 at 0:46
1

MySQL’s comment syntax requires a whitespace or control character after the --:

From a “-- ” sequence to the end of the line. In MySQL, the “-- ” (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax, as discussed in Section 1.7.2.4, “'--' as the Start of a Comment”.

The additionally included character in your cases probably just prevents the removal of the trailing whitespace or control character required by MySQL.

0

// is a way to comment out a line in PHP and possibly other languages, so it would make sense that you may be causing the rest of the query to be ignored. as far as the semicolon is to tell it the line is finished. If its a multi-line code you are making it comment out the rest and tell it to execute the line up to the semicolon.

you may want to try your injection before the // and end it with ;

Additionally, depending on how the query was run you may be able to write your own additional query's by separating them with ;

  • 2
    What would PHP code that would take a comment delimiter in a variable look like? Do you think they have a call to eval for the database access? If they do, that would be a lovely PHP injection vulnerability. – Neil Smithline Oct 16 '15 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.