Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

why do i have to use the concatenation operator when SQL injecting ?

etherr | Last updated: May 07, 2021 08:52PM UTC

hello . i am doing the sql injection labs . i got stuck on the blind sql injection labs . i got lost when i saw this query on the solution : ''' TrackingId=xyz'||(SELECT CASE WHEN SUBSTR(password,1,1)='§a§' THEN TO_CHAR(1/0) ELSE '' END FROM users WHERE username='administrator')||' ''' why do we have to use this operator ? (||) i managed to get the same query parameters by myself but i used --comment in the end . why is this wrong ? i saw it again on the next lab which runs on postgresql : ''' TrackingId=xyz'||pg_sleep(10)-- ''' but this time he used comment . and yet we could have used --comment on the oracle example but it didnt work . this got me really lost . i hope u can help me with that . thank you

Uthman, PortSwigger Agent | Last updated: May 10, 2021 02:53PM UTC