0

What is the meaning of this command in SQL ?

php?que_id
=-1/**/UNION/**/
ALL/**/SELECT

What does /**/? indicate here?

  • @paj28 Write it as an answer and I'll +1 – Purefan Feb 5 '16 at 12:57
3

This is an empty SQL comment, and is treated the same as a space.

This trick can be used to get around filters that strip out spaces. It may also be introduced to bypass a WAF or IDS.

  • Can it attack the database and lead to high risk ? – user45475 Feb 5 '16 at 13:54
  • @user45475 It depends on your PHP app. If coded securely you're ok. But if there's an SQL injection vulnerability in that parameter, then yes, this absolutely can attack the database, and most likely extract all the data. – paj28 Feb 5 '16 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.