What is the meaning of this command in SQL ?


What does /**/? indicate here?

  • @paj28 Write it as an answer and I'll +1
    – Purefan
    Feb 5 '16 at 12:57

This is an empty SQL comment, and is treated the same as a space.

This trick can be used to get around filters that strip out spaces. It may also be introduced to bypass a WAF or IDS.

  • Can it attack the database and lead to high risk ?
    – user45475
    Feb 5 '16 at 13:54
  • @user45475 It depends on your PHP app. If coded securely you're ok. But if there's an SQL injection vulnerability in that parameter, then yes, this absolutely can attack the database, and most likely extract all the data.
    – paj28
    Feb 5 '16 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.