I have come across a CTF challenge that has a part with an SQL injection (MySQL DB). I have completed it, but I do not know why or how the injection works. The query in the PHP application would probably be like this:
SELECT * FROM users WHERE email = '[email protected]' AND password = md5('1234'); And the injection code I entered in the text field :
[email protected]' OR 1 = 1 LIMIT 1 -- ' ] Would probably result in a query like this:
SELECT * FROM users WHERE email = '[email protected]' OR 1 = 1 LIMIT 1 -- ' ] AND password = md5('1234'); It doesn't work without the ], but I do not understand the use of ] here. Please explain it to me!
]necessary? The--is an SQL comment, so theoretically nothing after that should matter anyway. Naively, I would expect this to work equally well without the]--. Are there any other characters that work in place of]?]is the delimiter for tokens-used-as-identifiers (that is, a table named[Table]or similar) and strict casing/whitespace in SQL Server. Perhaps the filter was intended to work for SQL Server? I can't check whether--would be valid in a table name at the moment.