Comment Out Query

The following methods can be used to comment out the rest of a query after your injection:

Examples

SELECT * FROM Users WHERE username = '' OR 1=1 --' AND password = '';

SELECT * FROM Users WHERE username = '' OR 1=1 /*' AND password = ''*/;

Notes

• PostgreSQL uses standard SQL comment syntax
• The -- comment extends to the end of the line, and needs no space after it: SELECT 1--1 returns 1
• A carriage return (%0D) ends a -- comment as well as a line feed, so code after %0D runs: ' OR 1=1--x%0D AND 1=0 keeps the AND 1=0. MySQL, MariaDB and Oracle only end it at a line feed, which lets one payload behave differently per database
• Block comments /* */ can be nested in PostgreSQL (unlike some other databases)
• The # hash comment (used in MySQL) does NOT work in PostgreSQL