title: SQL Injection Authentication Bypass Question
body: <p>I will make this short and go straight to the point.</p>
  
  <p>I am testing SQLI Login bypass on a PHP Code I have made below.</p>
  
  <pre><code>if(isset($_POST["login"]) &amp;&amp; isset($_POST["password"])){
  
  
  $sql="select * from users where login='{$_POST["login"]}' and password='{$_POST["password"]}'";
  
  
  $result=mysqli_query($conn, $sql);
  
  
  if(mysqli_num_rows($result) != 0)
      echo "&lt;h1&gt;Login Success!&lt;/h1&gt;";
  
  
  else
      echo "&lt;h1&gt;Invalid Login!&lt;/h1&gt;";
  
  
  } 
  </code></pre>
  
  <p>I am using <strong>admin' --</strong> as the login field in order to successfully bypass login without entering  a password.</p>
  
  <p>But the problem is it doesn't work but when I tried using this <strong>admin' -- ' --</strong> instead it works.</p>
  
  <p>So question is how and why does that particular cheat sheet works instead but not the first one?</p>
  
  <p>This <strong>admin' -- ' --</strong> works but not this <strong>admin' --</strong></p>
  
  <p>These are the server-side code when I enter these 2 cheat sheets.</p>
  
  <p>The bypass that doesn't work.</p>
  
  <pre><code>$sql="select * from users where login='admin' --' and password='{$_POST["password"]}'"; 
  </code></pre>
  
  <p>The bypass that works.</p>
  
  <pre><code>$sql="select * from users where login='admin' -- ' --' and password='{$_POST["password"]}'"; 
  </code></pre>
  
  <p>Just need some clarification or explanation on how and why the 1st cheat sheet doesn't work but the 2nd one works. Thank you!</p>