SQL Injection query error with backslash

Question

I have a sql injection vulnerable site which works well if i input query like this qq' -- // or qq' -- ; . But when i inject without slash or semi-colon it throws following error "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '--%'' at line 1"

So what is the use of slash or semi-colon in the query, please explain the scenario.

Answer 1

MySQL’s comment syntax requires a whitespace or control character after the --:

From a “-- ” sequence to the end of the line. In MySQL, the “-- ” (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax, as discussed in Section 1.7.2.4, “'--' as the Start of a Comment”.

The additionally included character in your cases probably just prevents the removal of the trailing whitespace or control character required by MySQL.

Answer 2

// is a way to comment out a line in PHP and possibly other languages, so it would make sense that you may be causing the rest of the query to be ignored. as far as the semicolon is to tell it the line is finished. If its a multi-line code you are making it comment out the rest and tell it to execute the line up to the semicolon.

you may want to try your injection before the // and end it with ;

Additionally, depending on how the query was run you may be able to write your own additional query's by separating them with ;