SQL injections don't seem to work

Question

I'm trying to execute a SQLi but the mysql gives a error response. The input should comment everything from after the two dashes out so it can result in this: '%'. Instead it gives this error: '--%''.

This is the code I'm using to execute the query with.

if(isset($_GET['test'])){

    $test = $_GET['test'];

    //test
    $res = $db->run_query_find_all( "SELECT * FROM product WHERE name LIKE '%$test%'");

    while($product = $res->fetch_assoc()){
        print_r($product);
    }

}

Input

';--

In editor example:

Response:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '--%'' at line 1

Update

I still get an error even if I simplify my SQLi. When I do a POST request with the same query it shows no errors, but shows all the rows of the Product table which means the SQLi was succesfull.

Input: '--

Input: '#

Answer 1

First of, let's look at your input:

'   <-- this closes the quoted string
;   <-- this closes the SELECT statement
--  <-- this comments out the rest

This doesn't actually make that much sense. Even if your run_query_find_all function supports multi-queries - which is unlikely - why would you want to create a new query just to comment it out? [It actually shouldn't cause a problem, but it's also not needed, and it's always good to keep your payload as simple as possible; complexity makes it difficult to see where the actual errors are]

This means we can simplify your payload to '--.

Now we have this:

'   <-- this closes the quoted string
--  <-- this comments out the remaining characters, so that we have a valid query

We still get an error though. The MySQL comment documentation explains why:

From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on).

You need a whitespace character after the double-dash comment. So either add it, or use a different comment character:

'-- -   <-- will work
'#       <-- will also work (URL encode as %23 if needed)

Note that I added another character after the whitespace to avoid the whitespace being trimmed.

Answer 2

The documentation says:

In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax.