Why should we sometimes use --+ instead of — in SQL injection to comment the rest of the query?

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
9
down vote

favorite












I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked.



In the MySQL official documentation there is no such thing as --+ and we only have -- and two other ways:



https://dev.mysql.com/doc/refman/8.0/en/comments.html



Why does this happen (in detail)? I want to know exactly why this works sometimes and -- doesn't, and why there is no --+ for comments in the MySQL man page?






http sql-injection mysql







share|improve this question



















  • 1




    I suppose your question is more related to HTTP than to SQL...
    – Your Common Sense
    11 hours ago






  • 2




    @YourCommonSense i had no idea its related to HTTP and not SQL, so why this happens?
    – Richard Jones
    10 hours ago










  • You can also use # which doesn't need a space after
    – paj28
    10 hours ago














up vote
9
down vote

favorite












I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked.



In the MySQL official documentation there is no such thing as --+ and we only have -- and two other ways:



https://dev.mysql.com/doc/refman/8.0/en/comments.html



Why does this happen (in detail)? I want to know exactly why this works sometimes and -- doesn't, and why there is no --+ for comments in the MySQL man page?






http sql-injection mysql







share|improve this question



















  • 1




    I suppose your question is more related to HTTP than to SQL...
    – Your Common Sense
    11 hours ago






  • 2




    @YourCommonSense i had no idea its related to HTTP and not SQL, so why this happens?
    – Richard Jones
    10 hours ago










  • You can also use # which doesn't need a space after
    – paj28
    10 hours ago












up vote
9
down vote

favorite









up vote
9
down vote

favorite











I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked.



In the MySQL official documentation there is no such thing as --+ and we only have -- and two other ways:



https://dev.mysql.com/doc/refman/8.0/en/comments.html



Why does this happen (in detail)? I want to know exactly why this works sometimes and -- doesn't, and why there is no --+ for comments in the MySQL man page?






http sql-injection mysql







share|improve this question















I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked.



In the MySQL official documentation there is no such thing as --+ and we only have -- and two other ways:



https://dev.mysql.com/doc/refman/8.0/en/comments.html



Why does this happen (in detail)? I want to know exactly why this works sometimes and -- doesn't, and why there is no --+ for comments in the MySQL man page?






http sql-injection mysql




http sql-injection mysql






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited 10 mins ago









Boann

1795




1795










asked 11 hours ago









Richard Jones

543




543







  • 1




    I suppose your question is more related to HTTP than to SQL...
    – Your Common Sense
    11 hours ago






  • 2




    @YourCommonSense i had no idea its related to HTTP and not SQL, so why this happens?
    – Richard Jones
    10 hours ago










  • You can also use # which doesn't need a space after
    – paj28
    10 hours ago












  • 1




    I suppose your question is more related to HTTP than to SQL...
    – Your Common Sense
    11 hours ago






  • 2




    @YourCommonSense i had no idea its related to HTTP and not SQL, so why this happens?
    – Richard Jones
    10 hours ago










  • You can also use # which doesn't need a space after
    – paj28
    10 hours ago







1




1




I suppose your question is more related to HTTP than to SQL...
– Your Common Sense
11 hours ago




I suppose your question is more related to HTTP than to SQL...
– Your Common Sense
11 hours ago




2




2




@YourCommonSense i had no idea its related to HTTP and not SQL, so why this happens?
– Richard Jones
10 hours ago




@YourCommonSense i had no idea its related to HTTP and not SQL, so why this happens?
– Richard Jones
10 hours ago












You can also use # which doesn't need a space after
– paj28
10 hours ago




You can also use # which doesn't need a space after
– paj28
10 hours ago










1 Answer
1






active

oldest

votes

















up vote
23
down vote













From the documentation:




From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax, as discussed in Section 1.8.2.4, “'--' as the Start of a Comment”.




(emphasis mine)



Many URL decoders treat + as a space.






share|improve this answer




















    Your Answer







    StackExchange.ready(function()
    var channelOptions =
    tags: "".split(" "),
    id: "162"
    ;
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function()
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled)
    StackExchange.using("snippets", function()
    createEditor();
    );

    else
    createEditor();

    );

    function createEditor()
    StackExchange.prepareEditor(
    heartbeatType: 'answer',
    convertImagesToLinks: false,
    noModals: false,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: null,
    bindNavPrevention: true,
    postfix: "",
    noCode: true, onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    );



    );













     

    draft saved


    draft discarded


















    StackExchange.ready(
    function ()
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f196169%2fwhy-should-we-sometimes-use-instead-of-in-sql-injection-to-comment-the-re%23new-answer', 'question_page');

    );

    Post as a guest

















    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes








    up vote
    23
    down vote













    From the documentation:




    From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax, as discussed in Section 1.8.2.4, “'--' as the Start of a Comment”.




    (emphasis mine)



    Many URL decoders treat + as a space.






    share|improve this answer
























      up vote
      23
      down vote













      From the documentation:




      From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax, as discussed in Section 1.8.2.4, “'--' as the Start of a Comment”.




      (emphasis mine)



      Many URL decoders treat + as a space.






      share|improve this answer






















        up vote
        23
        down vote










        up vote
        23
        down vote









        From the documentation:




        From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax, as discussed in Section 1.8.2.4, “'--' as the Start of a Comment”.




        (emphasis mine)



        Many URL decoders treat + as a space.






        share|improve this answer












        From the documentation:




        From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax, as discussed in Section 1.8.2.4, “'--' as the Start of a Comment”.




        (emphasis mine)



        Many URL decoders treat + as a space.







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered 10 hours ago









        AndrolGenhald

        7,69441427




        7,69441427



























             

            draft saved


            draft discarded















































             


            draft saved


            draft discarded














            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f196169%2fwhy-should-we-sometimes-use-instead-of-in-sql-injection-to-comment-the-re%23new-answer', 'question_page');

            );

            Post as a guest
































































            Comments

            Post a Comment

            Popular posts from this blog

            What does second last employer means? [closed]

            Image
            Clash Royale CLAN TAG #URR8PPP .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty margin-bottom:0; up vote -3 down vote favorite Say, for example I have worked in the following companies, Company A => 2010 - 2011 Company B => 2011 - 2012 Company C => 2012 - Till Date Company D => Have offer Now assume Company D is asking to submit documents from my second last employer. So from the list of companies given, which company would be qualified as second last employer? software-industry employer share | improve this question asked Aug 10 '14 at 5:16 Rajaprabhu Aravindasamy 559 1 6 13 closed as off-topic by Jim G., jmort253 ♦ Aug 11 '14 at 1:58 This question appears to be off-topic. The users who voted to close gave this specific reason: "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address...
            Read more

            Installing NextGIS Connect into QGIS 3?

            Image
            Clash Royale CLAN TAG #URR8PPP .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty margin-bottom:0; up vote 1 down vote favorite Just acquired free version of NEXTGIS and trying to install the plugin for QGIS. It tells me it was not designed for version 3 of QGIS. How do I set up the QGIS-NEXTGIS interface then? qgis qgis-plugins nextgis share | improve this question edited 3 hours ago PolyGeo ♦ 51.9k 17 77 233 asked 4 hours ago IanGS 16 4 New contributor IanGS is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct. add a comment  |  up vote 1 down vote favorite Just acquired free version of NEXTGIS and trying to install the plugin for QGIS. It tells me it was not designed for version 3 of QGIS. How do I set up the QGIS-NEXTGIS interface then? qgis qgis-plugin...
            Read more

            One-line joke

            A one-liner is a joke that is delivered in a single line. A good one-liner is said to be pithy - concise and meaningful. [1] Comedians and actors use this comedic method as part of their act, e.g. Jimmy Carr, Tommy Cooper, Rodney Dangerfield, Norm Macdonald, Ken Dodd, Stewart Francis, Zach Galifianakis, Mitch Hedberg, Anthony Jeselnik, Milton Jones, Shappi Khorsandi, Jay London, Mark Linn-Baker, Demetri Martin, Groucho Marx, Dan Mintz, Emo Philips, Tim Vine, Steven Wright and Henny Youngman and Arnold Schwarzenegger. [ citation needed ] Many fictional characters are also known to deliver one-liners, including James Bond, who usually includes pithy and laconic quips after disposing of a villain. [ citation needed ] Examples "A baby seal walks into a club." "A dyslexic man walks into a bra." (Anonymous) "There are three types of people, those who can count and those who can't." "Venison's dear, isn't it?" (Jimmy Carr) "An escala...
            Read more