What does / * mean in sql?

I saw the sample code for the sql injection example as shown below, what does '/ *' mean in sql?

$_POST['username'] = chr(0xbf) . chr(0x27) . ' OR username = username /*';

$_POST['password'] = 'guess';

$mysql['username'] = addslashes($_POST['username']);

$mysql['password'] = addslashes($_POST['password']);

$sql = "SELECT * FROM   users WHERE  username = '{$mysql['username']}' AND password = '{$mysql['password']}'";

$result = $db->query($sql);
+5
source share
3 answers

/*This is the beginning of the comment. */concludes the comment. An attacker is trying to comment on the remainder of the request.

+8
source

/* starts a comment, so everything after that is ignored until it meets */

Your attacker submitted an open comment, thereby invalidating the password verification effect

0
source

/*

:

/*

CREATE PROC A_SAMPLE_PROC

BEGIN

AS
SELECT * FROM A_SAMPLE_TABLE
END

*/

while -- . MS SQL Server Studio - Ctrl + K, Ctrl + C

0

All Articles