49

I understand when they put a + at the end, URL treats it like a space.

I want to know what -- - does. I do know what the "double dash" does. Including the double dash with a "space at the end". I specifically want to know what a dash-dash-space-dash does.

Improve this question
2
  • 2
    It is also used by Little Bobby Tables.
    – Peter Mortensen
    Apr 1, 2020 at 3:19
  • 1
    @Peter Mortensen: Disagree -- I think the question-mark is part of the school administrator's sentence, not part of the name he is quoting. Munroe neglected to sanitize the comic's dialog with delimiting quotes.
    – A. I. Breveleri
    Apr 1, 2020 at 4:15

1 Answer 1

Reset to default
90

The last dash basically protects the trailing space. If you exploit SQL injection in a browser (e.g. via the URL), some browsers remove trailing space characters. Some prominent SQL flavors explicitly require the Space after Dash-Dash to treat the sequence as the start of a comment, so attackers often add a character after the Space to protect it against such browser optimization.

You could use any character to accomplish this. -- x would do exactly the same.

Improve this answer
8
  • 1
    So is "-- -" the exact same as "--+" and "--%20" when it comes to what it's effect is? As in the browser will just treat the last space AS space? So why do so many of the Youtube hackers first try "--+" and then they try"-- -" if it has the same effect?
    – Linux Newbie
    Mar 31, 2020 at 16:04
  • 34
    I have seen the removal of trailing spaces mostly in the browser, but it is also possible that trailing spaces are removed on server side. So you cannot be sure that encoding the space as + or %20 will always do the trick. So it is just a safety net, because if "-- " is treated as comment, the final Dash will not hurt anyway.
    – Demento
    Mar 31, 2020 at 16:16
  • 6
    Reminds me of my first SQL Injection. I didn't know that MySQL treats -- without a trailing space like -, and pulled my hair out trying to figure out why it wasn't working.
    – user163495
    Apr 1, 2020 at 10:40
  • 1
    @Andrew Savinykh: All browsers remove the extra space at the end, because it's redundant. You can examine the sent URL's using tools like Burp Suite.
    – Linux Newbie
    Apr 1, 2020 at 10:52
  • 3
    @Demento SQL Server at least doesn't require the space after '--' to recognise the start of a comment.
    – BWFC
    Apr 1, 2020 at 13:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .