Welcome to the Lounge

Espen Harlinn11-Mar-21 15:06

Espen Harlinn

11-Mar-21 15:06

SELECT * FROM test WHERE id= /*/*/ 100

No star needed, just /

Espen Harlinn
Senior Architect - Ulriken Consulting AS

The competent programmer is fully aware of the strictly limited size of his own skull; therefore he approaches the programming task in full humility, and among other things he avoids clever tricks like the plague.Edsger W.Dijkstra

Jon McKee11-Mar-21 16:08

Jon McKee

11-Mar-21 16:08

Just tested this with MySQL and it works fine. What db does this fail with for you?

Espen Harlinn11-Mar-21 21:11

Espen Harlinn

11-Mar-21 21:11

SQL Server:
Msg 113, Level 15, State 1, Line 1
Missing end comment mark '/'.
Msg 113, Level 15, State 1, Line 1
Missing end comment mark '/'.
Msg 102, Level 15, State 1, Line 1
Incorrect syntax near '='.

modified 12-Mar-21 3:52am.

Jörgen Andersson11-Mar-21 22:47

Jörgen Andersson

11-Mar-21 22:47

Because SQL Server allows nested comment blocks.

"Nested comments are supported. If the /* character pattern occurs anywhere within an existing comment, it is treated as the start of a nested comment and, therefore, requires a closing */ comment mark. If the closing comment mark does not exist, an error is generated." - SQL Server | Microsoft Docs[^]

Wrong is evil and must be defeated. - Jeff Ello

Sandeep Mewara11-Mar-21 17:50

Sandeep Mewara

11-Mar-21 17:50

Even if this works, INPUT cannot have * in it. Smile | :)

Latest CodeProject post:
Quick look into Machine Learning workflow
How to solve Word Ladder Problem?

To read all my blog posts, visit: Learn by Insight...

Espen Harlinn11-Mar-21 21:12

Espen Harlinn

11-Mar-21 21:12

Quote:
Even if this works, INPUT cannot have * in it.

It doesn't - I just replaced " INPUT " with "/"

Nelek11-Mar-21 22:15

Nelek

11-Mar-21 22:15

The used * are yours, not his

M.D.V.

If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.

Peter_in_278011-Mar-21 20:20

Peter_in_2780

11-Mar-21 20:20

Did you try:

1. HTML entities, like &#42
2. ASCII/Unicode in hex/octal \x2a \u002a \052

Some of those might sneak through.

Just a thought from someone who knows nothing of your environment.

Software rusts. Simon Stephenson, ca 1994. So does this signature. me, 2012

DerekT-P11-Mar-21 22:58

DerekT-P

11-Mar-21 22:58

In MySql or MariaDB, most values of INPUT starting with an exclamation mark will cause a syntax error IF there is no space between your opening comment tag and INPUT, eg:

SQL

SELECT * FROM test WHERE id= /*! oops */ 100

However it's also possible to inject valid SQL that way:

SQL

SELECT * FROM test WHERE ID= /*!0 OR ID > 0 OR ID= */ 100

This query returning all rows in the table. See MySql ref: Comments[^] The idea is that you can then write SQL that works across DBMS, by including code that is only "seen" by MySql.

You can also include query optimiser hints using a similar /*+ hint */ syntax, so you could probably break your query by starting INPUT with a plus sign as well, again only provided there's no space after the opening asterisk.

And yes, this is definitely too much of a programming question to be in the Lounge! Laugh | :laugh:

obermd12-Mar-21 3:22

obermd

12-Mar-21 3:22

Won't a semi-colon (;) cause that comment to end?

PIEBALDconsult12-Mar-21 3:47

12-Mar-21 3:47

No.

Message Closed

11-Mar-21 8:06

User 15056879

11-Mar-21 8:06

Message Closed

modified 5-Apr-21 21:01pm.

User 1505687911-Mar-21 8:12

User 15056879

11-Mar-21 8:12

And what the f... is the difference between this and the post just below?
@chris-maunder can you answer that?

[Edit]
No need to answer, also the above one is closed Confused | :confused:

Pay attention to the 'body guards' of this forum D'Oh! | :doh:

modified 5-Apr-21 21:01pm.

NotTodayYo11-Mar-21 9:05

NotTodayYo

11-Mar-21 9:05

Are you arguing with yourself?

User 1505687911-Mar-21 9:07

User 15056879

11-Mar-21 9:07

Looks like

modified 5-Apr-21 21:01pm.

NotTodayYo11-Mar-21 9:13

NotTodayYo

11-Mar-21 9:13

Sorry for interrupting. Carry on. Wink | ;)

Programming peeve of the Day

glennPattonWork311-Mar-21 11:18

glennPattonWork3

11-Mar-21 11:18

When ever I see message closed, I always wonder what was there, spam most likely, dodgy web links the mind boggels, having come across some before they stompend they are not very interesting but...

Chris Maunder11-Mar-21 7:48

Chris Maunder

11-Mar-21 7:48

if (condition)
{
    return;
}
else
{
    // Do something else
}

cheers
Chris Maunder

PIEBALDconsult11-Mar-21 7:54

11-Mar-21 7:54

But it's expressive.

Slacker00711-Mar-21 7:54

Slacker007

11-Mar-21 7:54

if (condition)
{
    return;
}

// Do something else

what about this annoys you?

Chris Maunder11-Mar-21 7:56

Chris Maunder

11-Mar-21 7:56

Your rewrite is how it should be done.

Now get off my lawn.

cheers
Chris Maunder

PIEBALDconsult11-Mar-21 8:18

11-Mar-21 8:18

Is snot.

if ( !condition )
{
  // Do something else
}

return ;

Mike Hankey11-Mar-21 8:52

Mike Hankey

11-Mar-21 8:52

I believe to be totally proper it should be;

if ( !condition )
{
  // Do something else
  return;
}

return ;

The less you need, the more you have.

JaxCoder.com

PIEBALDconsult11-Mar-21 8:55