Skip to content
BackEsc
Sign in

SQL Injection · passage 113 of 186

MySQL Injection: Conditional Comments

Text · SQL Injection/MySQL Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

MySQL conditional comments are enclosed within `/*! ... */` and can include a version number to specify the minimum version of MySQL that should execute the contained code. The code inside this comment will be executed only if the MySQL version is greater than or equal to the number immediately following the `/*!`. If the MySQL version is less than the specified number, the code inside the comment will be ignored. * `/*!12345UNION*/`: This means that the word UNION will be executed as part of the SQL statement if the MySQL version is 12.345 or higher. * `/*!31337SELECT*/`: Similarly, the word SELECT will be executed if the MySQL version is 31.337 or higher. **Examples**: `/*!12345UNION*/`, `/*!31337SELECT*/`

Source: SQL Injection/MySQL Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 105 to 130, reading order first.

  1. MySQL Injection: MYSQL Truncation§ 1051 code block · MySQL Injection.md
  2. MySQL Injection: MYSQL Out of Band§ 1061 code block · MySQL Injection.md
  3. MySQL Injection: DNS Exfiltration§ 1071 code block · MySQL Injection.md
  4. MySQL Injection: UNC Path - NTLM Hash Stealing§ 1081 code block · MySQL Injection.md
  5. MySQL Injection: Alternative to Information Schema§ 1091 code block · MySQL Injection.md
  6. MySQL Injection: Alternative to VERSION§ 1101 code block · MySQL Injection.md
  7. MySQL Injection: Alternative to GROUPCONCAT§ 1111 code block · MySQL Injection.md
  8. MySQL Injection: Scientific Notation§ 112text · MySQL Injection.md
  9. MySQL Injection: Conditional Comments§ 113text · MySQL Injection.md
  10. MySQL Injection: Wide Byte Injection (GBK)§ 1142 code blocks · MySQL Injection.md
  11. OracleSQL Injection: Oracle SQL Injection§ 115text · OracleSQL Injection.md
  12. OracleSQL Injection: Oracle SQL Default Databases§ 116text · OracleSQL Injection.md
  13. OracleSQL Injection: Oracle SQL Comments§ 117text · OracleSQL Injection.md
  14. OracleSQL Injection: Oracle SQL Enumeration§ 118text · OracleSQL Injection.md
  15. OracleSQL Injection: Oracle SQL Database Credentials§ 119text · OracleSQL Injection.md
  16. OracleSQL Injection: Oracle SQL List Databases§ 1201 code block · OracleSQL Injection.md
  17. OracleSQL Injection: Oracle SQL List Tables§ 1211 code block · OracleSQL Injection.md
  18. OracleSQL Injection: Oracle SQL List Columns§ 1221 code block · OracleSQL Injection.md
  19. OracleSQL Injection: Oracle SQL Error Based§ 123text · OracleSQL Injection.md
  20. OracleSQL Injection: Oracle SQL Blind§ 124text · OracleSQL Injection.md
  21. OracleSQL Injection: Oracle Blind With Substring Equivalent§ 125text · OracleSQL Injection.md
  22. OracleSQL Injection: Oracle SQL Time Based§ 1261 code block · OracleSQL Injection.md
  23. OracleSQL Injection: Oracle SQL Out of Band§ 1271 code block · OracleSQL Injection.md
  24. OracleSQL Injection: Oracle SQL Command Execution§ 128text · OracleSQL Injection.md
  25. OracleSQL Injection: Oracle Java Execution§ 129text · OracleSQL Injection.md
  26. OracleSQL Injection: Oracle Java Class§ 130text · OracleSQL Injection.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in