1

I'm trying to execute a SQLi but the mysql gives a error response. The input should comment everything from after the two dashes out so it can result in this: '%'. Instead it gives this error: '--%''.

This is the code I'm using to execute the query with.

if(isset($_GET['test'])){

    $test = $_GET['test'];

    //test
    $res = $db->run_query_find_all( "SELECT * FROM product WHERE name LIKE '%$test%'");

    while($product = $res->fetch_assoc()){
        print_r($product);
    }

}

Input

';--

In editor example:

enter image description here

Response:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '--%'' at line 1

Update

I still get an error even if I simplify my SQLi. When I do a POST request with the same query it shows no errors, but shows all the rows of the Product table which means the SQLi was succesfull.

Input: '--

Input: '#

enter image description here

4

First of, let's look at your input:

'   <-- this closes the quoted string
;   <-- this closes the SELECT statement
--  <-- this comments out the rest

This doesn't actually make that much sense. Even if your run_query_find_all function supports multi-queries - which is unlikely - why would you want to create a new query just to comment it out? [It actually shouldn't cause a problem, but it's also not needed, and it's always good to keep your payload as simple as possible; complexity makes it difficult to see where the actual errors are]

This means we can simplify your payload to '--.

Now we have this:

'   <-- this closes the quoted string
--  <-- this comments out the remaining characters, so that we have a valid query

We still get an error though. The MySQL comment documentation explains why:

From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on).

You need a whitespace character after the double-dash comment. So either add it, or use a different comment character:

'-- -   <-- will work
'#       <-- will also work (URL encode as %23 if needed)

Note that I added another character after the whitespace to avoid the whitespace being trimmed.

1

The documentation says:

In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.