There are some details which I would have wanted for a better understanding, but I'm assuming that you are trying to send malicious SQLi in a search parameter.
Let me use an example that you are searching for the term 'shoes'
The web request for that might be:
The SQL query for that request might use
LIKE. I have used
LIKE specifically because you are targetting search box. It would be a rare case or a very app-specific case where instead of LIKE, a direct comparison (=) is done.
SELECT * FROM table_name WHERE searchtext LIKE 'shoes' AND SOME_CONDITION
Now let's insert your given SQL queries:
' or 1=1-- -> This will convert the query to
SELECT * FROM table_name where searchtext LIKE '' or 1=1 . Rest of the query gets commented out.
' or '1'='1 -> This will convert the query to
SELECT * from table_name where searchtext LIKE '' or '1'='1' AND SOME_CONDITION . This causes a different query to execute than above. Depending on the condition or the subquery the results will be altered.
' or '1'='1-- -> This will convert the query to
SELECT * from table_name where searchtext LIKE '' or '1'='1 . Its an INVALID QUERY. This query should not execute as the quotes are imbalanced. The application might be handling exceptions, hence you are able to see 0 results, otherwise, you would have seen SQL error on your web app.