EXERCISE 2 — The role of the SQL comment in a login bypass
===========================================================

WHAT ROLE A COMMENT ( -- ) PLAYS:
  - After you inject into the MIDDLE of a query, the developer's ORIGINAL query
    CONTINUES — typically with a trailing quote and more conditions
    (e.g. ...' AND password = '...'). That leftover text would make your
    injected SQL fail to parse (unbalanced quotes / unexpected tokens).
  - A SQL comment tells the database to IGNORE EVERYTHING AFTER IT on the line.
    So instead of carefully balancing the rest of the query, you just COMMENT
    IT OUT — discarding the trailing quote, the AND password check, etc. This
    is the "fix-up" move: make the remaining query vanish so only your part
    runs.

THE LOGIN QUERY:
  SELECT * FROM users WHERE username = '$u' AND password = '$p'

THE USERNAME PAYLOAD TO LOG IN AS admin WITH NO PASSWORD:
  username:  admin'--␣        (note: -- followed by a SPACE; ␣ = space)
  password:  (anything, e.g. x)

THE RESULTING QUERY:
  SELECT * FROM users WHERE username = 'admin'-- ' AND password = 'x'
                                              └────── commented out ──────┘
  Effectively:
  SELECT * FROM users WHERE username = 'admin'
  - admin' closes the username string with the value "admin".
  - --␣ comments out the rest (' AND password = 'x'), so the password check is
    GONE.
  - The query returns the admin row -> the app logs you in as admin with no
    valid password. This is an AUTHENTICATION BYPASS (Auth course) caused
    purely by query construction.

WHY THE TRAILING SPACE ON  --  MATTERS:
  - In standard SQL (and notably MySQL), the -- comment introducer requires the
    dashes to be FOLLOWED BY A WHITESPACE character (space/tab/newline) to be
    recognized as a comment. "--" immediately followed by a non-space may NOT
    start a comment in MySQL, causing the payload to fail.
  - So attackers write "-- " (dash dash space). Equivalent robust variants:
      admin'-- -        (dash-space-dash: guarantees a space after --)
      admin'#           (# is a comment in MySQL, no trailing space needed)
      admin'/*          (start of an inline comment, on engines that allow it)
  - When testing/reading payloads, the seemingly-cosmetic space after -- is
    functionally required; "admin'--" (no space) can behave differently from
    "admin'-- ".

KEY POINT:
  The comment isn't the injection itself — it's the cleanup that lets the
  injection parse by deleting the developer's trailing SQL (here, the password
  condition). Remove the password check and the login query authenticates you
  as any username you name. Parameterized queries make 'admin'-- a literal
  username string that simply won't match, neutralizing it entirely.