SQL Injection syntax inquiry-commented injections

Question

I have some programming experience, but am having trouble with SQL injection code. I don't understand why there's sometimes SQL syntax after the comment character (such as -- or #). I know that -- - and --+ are just required comments syntax, but there are injection examples with much more complex syntax after the comment characters.

Specific example:

$statement = "SELECT * FROM users WHERE username ='Dean' OR '1'='1'-- ' AND password = 'WinchesterS'";

How is the syntax after the double-dashes able to be interpreted or executed in the database?

According to a site:

–(double hyphen) instructs the SQL parser that the rest of the line is a comment and should not be executed

I've been researching for quite some time but can't figure it out.

Answer 1

In short, the syntax after the -- comment marker is part of the original query. For example, if the query was run without injection but with username "Dean" and password "WinchesterS", then the query would look like this:

SELECT * FROM users WHERE username ='Dean' AND password = 'WinchesterS';

The SQL Injection in this case is:

Dean' OR '1'='1'-- 

Now, if that is entered as the username field, it extends the username into a SQL OR statement, which will always be true, thus allowing login. However, the original end to the query is still in place:

' AND password = 'WinchesterS';

In order to avoid a syntax error, the -- comment marker is used to ignore that part of the original query.

Answer 2

You show the result of SQL injection. I suppose the original query looked as follows:

$statement = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";

In a normal case user enters following values:

• username: Dean
• password: Secret$123

Then the application generates following SQL:

$statement = "SELECT * FROM users WHERE username = 'Dean' AND password = 'WinchesterS'";

If the result of this query is not empty, then user and password was correct and user is authenticated.

But malicious user entered following:

• username: Dean' OR '1'='1'--
• password: WinchesterS (actually, it it does not matter)

If you substitute placeholders in the original query with these values, you will get following SQL:

$statement = "SELECT * FROM users WHERE username = 'Dean' OR '1'='1'-- ' AND password = 'WinchesterS'";

Database will consider -- as the beginning of the comment. Means, the effective SQL that will be executed is following:

SELECT * FROM users WHERE username = 'Dean' OR '1'='1'

The result of this query will be not empty if there is at least one record in the table users. Since the result of this query is not empty, user will be considered as authenticated. As we see, the password that user provided does not matter.