I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works?

I found this on login form where when I send user=\&pass=||1# as a payload I got successfully admin panel accessed.

This was the challenge. https://hack2learn.pw/mysql/login.php

  • WAIT` #` is an admin in MySQL? I thought it is a comment symbol. And what will be the use of 1 Commented Aug 29, 2018 at 7:14
  • 1
    @RobertHarvey || is logical OR 1 (true, match all rows) and then # starts a comment to discard/ignore trailing text from the query including the close quote from the password, preventing a syntax error from the injection. Commented Aug 29, 2018 at 9:49
  • Yup, that makes sense. Michael. Commented Aug 29, 2018 at 12:02

1 Answer 1


The query in question probably looks something like this:

SELECT * FROM users WHERE user = '$user' AND pass = '$pass'

The $user and $pass variables are likely sanitized by either removing or escaping " and/or '. That's why a standard attack of ' or '1'='1 or similar is not working.

With your injection, you will get the following query:

SELECT * FROM users WHERE user = '\' AND pass = '||1#'

As you are escaping the ' from the query, user is now compared to ' and pass = (which will likely evaluate to false, as no such user exists). # is a comment which cuts off the rest of the query, so ||1#' evaluates to OR true, which will be true. The authentication code will now likely fetch the first result of that query, or check if anything was returned, and thus authenticate you.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .