I am practicing SQL injection with DVWA, but for some reason the server keeps giving me an error even when I comment out extra '.

For example, here is what I inputed in my website:

http://localhost/DVWA/vulnerabilities/sqli/?id=' OR SLEEP(5) AND 'a'='a' /* 

But for some reason it still gives me an error even when I comment out all of the extra characters as shown in the URL when I used the /*. It keeps giving me the following error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'aaa'='aaa' /* '' at line 1.


The characters /* open a C style comment, but when the SQL parser cannot find the associated end of the comment */, it will not treat this as a comment.

Use a native SQL style comment -- (Dash Dash Space) which is implicitly closed by the next newline.

| improve this answer | |
  • That didn't work either, but I did find the solution I just used the # instead to comment out extra characters, but thanks for the help :) – Fumerian Gaming Jan 31 '17 at 5:15

OK. After hours of testing, and retrying I found that by using the # I was able to comment out all of my extra characters

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.