Which SQL injection character is commonly used to comment out the rest of a SQL query?

The correct answer is C. --. -- (double dash) is the standard single-line comment syntax in SQL (ANSI standard), making it the most universally recognized way to comment out the remainder of a query - for example, ' OR '1'='1' -- causes everything after the injected clause to be ignored by the database engin

Web Application Security

Question

Options

How the community answered

(52 responses)

A
4% (2)
B
8% (4)
C
87% (45)
D
2% (1)

Explanation

-- (double dash) is the standard single-line comment syntax in SQL (ANSI standard), making it the most universally recognized way to comment out the remainder of a query - for example, ' OR '1'='1' -- causes everything after the injected clause to be ignored by the database engine. # (option A) is a valid comment character in MySQL specifically, but it's not cross-platform and not the canonical answer for general SQL. // (option B) is a comment delimiter in languages like JavaScript and C++, not SQL. /* (option D) begins a multi-line block comment in SQL but requires a closing */ to be valid - it doesn't comment out the rest of a query on its own.

Memory tip: Think "double dash, double safe" - -- is the two-character sequence that ends the query just as two dashes visually signal a pause or termination.

Topics

#SQL Injection#Comment Syntax#SQL Payload#Query Manipulation

Community Discussion

No community discussion yet for this question.

Full 112-52 Practice