20

Does anyone know what something like OR 1# means in the context of mysql injection?

dreftymac
  • 31,404
  • 26
  • 119
  • 182
munchybunch
  • 6,033
  • 11
  • 48
  • 62
  • 2
    The `#` symbol has a few English names (number, octothorpe, hex, hash, sharp) that you *can* Google :) – BoltClock Nov 29 '10 at 03:44
  • :) thanks for helping me find completely unrelated pages! in all seriousness, I did Google for mysql pound symbol, etc, before asking and just got pages on british pounds – munchybunch Nov 29 '10 at 04:25
  • 4
    Ironically, this is now the top result if you search for `mysql hash symbol` and the second result for `mysql octothorpe`. – munchybunch May 15 '14 at 23:21
  • Top result for sharp sql, and still can't find the answer :/ edit : I've found an answer in third page : http://stackoverflow.com/questions/3166117/what-does-the-sql-symbol-mean-and-how-is-it-used – Alex Werner Jun 23 '16 at 08:15

2 Answers2

52

It is MySQL's version of the line comment delimiter. In standard SQL, the line comment delimiter is --.

-- This is a standard SQL comment.
# This is a MySQL comment.

So in the context of SQL injection, if the attacker knows you're using MySQL he may use it to abruptly terminate the malicious SQL statement, causing MySQL to ignore whatever is behind the # and execute only the stuff that comes before it. This is only effective against single-line SQL statements, however. Here's an example:

Input:

Username: fake' OR 1#
Password: pass

Resultant SQL:

SELECT * FROM users WHERE username = 'fake' OR 1#' AND password = 'pass'

Which is executed as this, which returns every row:

SELECT * FROM users WHERE username = 'fake' OR 1
BoltClock
  • 700,868
  • 160
  • 1,392
  • 1,356
1

This is the start of a comment. It means that anything after that will be skipped by the parser.

Xavier Poinas
  • 19,377
  • 14
  • 63
  • 95
  • 1
    @JD: a-ha, to protect against sql-injections we need more lines in our queries (irony) ;-) – zerkms Nov 29 '10 at 03:55