Why should we sometimes use --+ instead of -- in SQL injection to comment the rest of the query?

Question

I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked.

In the MySQL official documentation there is no such thing as --+ and we only have -- and two other ways.

Why does this happen (in detail)? I want to know exactly why this works sometimes and -- doesn't, and why there is no --+ for comments in the MySQL man page?

I suppose your question is more related to *HTTP* than to SQL... — Your Common Sense, Oct 22 '18 at 15:44
@YourCommonSense i had no idea its related to HTTP and not SQL, so why this happens? — Richard Jones, Oct 22 '18 at 16:01

score 59 · Accepted Answer · answered Oct 22 '18 at 16:05

59

From the documentation:

From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax, as discussed in Section 1.8.2.4, “'--' as the Start of a Comment”.

(emphasis mine)

Many URL decoders treat + as a space.

answered Oct 22 '18 at 16:05

AndrolGenhald

15,506
5
45
50

Comments are not for extended discussion; this conversation has been [moved to chat](https://chat.stackexchange.com/rooms/84883/discussion-on-answer-by-androlgenhald-why-should-we-sometimes-use-instead-of). – Rory Alsop Oct 24 '18 at 18:44

score 0 · Answer 2 · edited Feb 17 '23 at 12:31

0

MySQL requires a blank space followed by the double dashes like "-- " and a URL can't contain blank spaces but the + sign can be used as blank space. That's why these comments are followed up by "+".

edited Feb 17 '23 at 12:31

Glorfindel

2,263
6
19
30

answered Feb 17 '23 at 10:24

Prawal Chaudhary

1

Why should we sometimes use --+ instead of -- in SQL injection to comment the rest of the query?

2 Answers2

Linked