I have some programming experience, but am having trouble with SQL injection code. I don't understand why there's sometimes SQL syntax after the comment character (such as -- or #). I know that -- - and --+ are just required comments syntax, but there are injection examples with much more complex syntax after the comment characters.
$statement = "SELECT * FROM users WHERE username ='Dean' OR '1'='1'-- ' AND password = 'WinchesterS'";
How is the syntax after the double-dashes able to be interpreted or executed in the database?
According to the site where I found it: –(double hyphen) instructs the SQL parser that the rest of the line is a comment and should not be executed
I've been researching for quite some time but can't figure it out. Thank you