I am practicing SQL injection with DVWA, but for some reason the server keeps giving me an error even when I comment out extra '.

For example, here is what I inputed in my website:

http://localhost/DVWA/vulnerabilities/sqli/?id=' OR SLEEP(5) AND 'a'='a' /* 

But for some reason it still gives me an error even when I comment out all of the extra characters as shown in the URL when I used the /*. It keeps giving me the following error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'aaa'='aaa' /* '' at line 1.

2 Answers 2


The characters /* open a C style comment, but when the SQL parser cannot find the associated end of the comment */, it will not treat this as a comment.

Use a native SQL style comment -- (Dash Dash Space) which is implicitly closed by the next newline.

  • That didn't work either, but I did find the solution I just used the # instead to comment out extra characters, but thanks for the help :) Jan 31, 2017 at 5:15

OK. After hours of testing, and retrying I found that by using the # I was able to comment out all of my extra characters

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .