In SQL injection payloads, what does the sequence -- typically indicate?

• A. Commenting out the rest of the statement
• B. Triggering an error
• C. Validating input
• D. Ending the session

Answer: (A)

In SQL injection payloads, the sequence that starts a single-line comment is used to hide the rest of the original statement. When the attacker injects this marker into a query, the remainder of that line becomes a comment, so the database stops processing the rest of the intended SQL. This lets the injected portion run as the main command while the original query’s trailing syntax is ignored, helping the attacker shape the final query and avoid syntax errors. In many SQL dialects, this marker requires a space after the dashes to be treated as a comment.

This isn’t about triggering an error, validating input, or ending a session. It’s about turning the remainder of the existing query into a harmless comment so the injected payload can execute as intended.