I was performing a Web Pentest and I found this when i was doing sqli in a search field:

' or  1=1--     returns 15 results
' or '1'='1     returns 30 different results
' or '1'='1--   returns 0 results

What may be the cause? I mean, what is the difference between those queries?

  • 4
    it all depends on how it is concatenated with the server-side code ... – schroeder Oct 25 '17 at 13:52
  • 1
    The last one will always return zero results because. Try putting it into an SQL statement and you will see why. – Anders Oct 25 '17 at 14:15

The reason for the different results is that your first injection cuts off the rest of the query via the comment (--).

Your last injection likely returns nothing because it is invalid and causes an error (because of the unclosed ').

The query in which you are injecting likely has a structure like this:

... WHERE foo='your input' OR bar='something else'

It doesn't have to be exactly like this, but we do know that there has to be something after the point in which you are injecting.

Of course, theoretically it could also be that the search legitimately returns those results and there is no injection at all (in this case it's unlikely though). You should try other injections as well, such as ' and '1'='1, ' and sleep(10)-- -, actually extracting data, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.