/*! Select */breakthrough anti-Injection

Author: meao

When I checked a foreign PHP website yesterday
Add 'after id = 255 to show forbidden
So I and 1 = 1 normal and 1 = 2 error
It indicates there must be an injection.
Then I guess the field by order.
Then the union select 1, 2, 3, 4 // tragedy again appears forbidden
It must have been filtered out.
Then the statement id =-255 + union +/* is constructed /*! Select */+ 1, 2, 4

Principle:

MySQL Server supports some variants of C-style comments. These enable you to write code that includes des MySQL extensions, but is still portable, by using comments of the following form:

/*! MySQL-specific code */

In this case, MySQL Server parses and executes the code within the comment as it wowould any other SQL statement, but other SQL servers will ignore the extensions. for example, MySQL Server recognizes the STRAIGHT_JOIN keyword in the following statement, but other servers will not:

SELECT /*! STRAIGHT_JOIN */col1 FROM table1, table2 WHERE...

If you add a version number after the "!" Character, the syntax within the comment is executed only if the MySQL version is greater than or equal to the specified version number. the TEMPORARY keyword in the following comment is executed only by servers from MySQL 3.23.02 or higher:

CREATE /*! 32302 TEMPORARY */TABLE t (a INT );

The comment syntax just described applies to how the mysqld server parses SQL statements. the mysql client program also performs some parsing of statements before sending them to the server. (It does this to determine statement boundaries within a multiple-statement input line .)