This is the vulnerable code:

$order = isset($_GET["order{$i}"]) ? $_GET["order{$i}"] : '';
if (stripos($order, 'benchmark') !== false) die;
${"result$i"} = $db->query("SELECT * FROM {$tables[$i]} " . ($order != '' ? "ORDER BY `".$db->escape_string($order)."`" : ""));

escape_string doesn't filter backticks, so a possible payload could be


So the final url would be like https://vuln-app/?order0=winner`--
It doesn't work unless I add a space at the end like this:
I saw this happen on multiple occasions, yet I still don't understand the reason.
I would truly appreciate if someone could shed light on the underlying reason behind why this space is needed and what it does.
Thanks a lot.

  • 1
    What dialect of SQL is this? That may have an effect.
    – anon
    Commented Jul 3, 2019 at 16:36
  • I'm almost sure it's MySQL
    – Sam
    Commented Jul 3, 2019 at 17:22

1 Answer 1


According to the MySQL documentation, MySQL requires at least one whitespace character after the double dash for it to be registered as a comment.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .