nerdexam
EC-Council

312-50V9 · Question #117

Which of the following is used to indicate a single-line comment in structured query language (SQL)?

The correct answer is A. --. In SQL, two consecutive hyphens (--) mark the beginning of a single-line comment, causing everything that follows on that line to be ignored by the query parser.

SQL Injection

Question

Which of the following is used to indicate a single-line comment in structured query language (SQL)?

Options

  • A--
  • B||
  • C%%
  • D''

How the community answered

(27 responses)
  • A
    93% (25)
  • B
    4% (1)
  • C
    4% (1)

Why each option

In SQL, two consecutive hyphens (--) mark the beginning of a single-line comment, causing everything that follows on that line to be ignored by the query parser.

A--Correct

The double-hyphen (--) is the ANSI SQL standard single-line comment delimiter, supported by virtually all relational database engines including MySQL, SQL Server, PostgreSQL, and Oracle. In SQL injection attacks, it is commonly appended to a payload to nullify the remainder of the original query and prevent syntax errors.

B||

The double pipe (||) is the ANSI SQL string concatenation operator and has no role as a comment delimiter.

C%%

The percent sign (%) serves as a wildcard character in LIKE predicates; double percent (%%) is not valid SQL syntax.

D''

Single quotes ('') are used to delimit string literals in SQL and are not comment indicators.

Concept tested: SQL single-line comment syntax

Source: https://learn.microsoft.com/en-us/sql/t-sql/language-elements/comment-transact-sql

Topics

#SQL comments#SQL syntax#injection techniques#query manipulation

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice