title: Conditional/Executable Comments in MySQL/SQL Server
body: <p>Before I begin, I realize that what I'm attempting is bizarre and hackish.  It's just for an isolated pen test, specifically SQL Injection.</p>
  <p>What I need to do is write a SQL statement that behaves differently when executing on a MySQL database than it does when executing on a SQL Server Database.</p>
  <h2>Edit</h2>
  <p>The limitation of the Query I can build is that I can only change what's after the &quot;WHERE id =&quot; clause.  I can't affect any other part of the query.  Specifically, I need to be able to attach a &quot; UNION SELECT * FROM some_other_table&quot; that only gets executed by the SQL server to the end of my input.</p>
  <p>This obviously would blow up MySQL because it doesn't have the tables I'm unioning.</p>
  <p>Specifically:</p>
  <pre><code>SELECT * FROM USERS 
  WHERE id = My input -&gt; (MySQL code: 'x' or 1=1 )
                         (MSSQL code 'x' or 1=1 UNION SELECT * FROM table)
  </code></pre>
  <p>The problem is, if either statement gets executed by the database it wasn't meant for, it blows up (and not in the way I need it to).</p>
  <p>This lead to my discovery of <a href="http://dev.mysql.com/doc/refman/5.0/en/comments.html" rel="noreferrer">Conditional/Executable Comments in MySQL</a>.</p>
  <pre><code>SELECT * FROM USERS 
  WHERE id = /*! This will be executed but only by mysql */
  </code></pre>
  <p>That's great but I still can't prevent MySQL from executing MSSQL!  I can only stop MSSQL from executing MySQL code.</p>
  <p>My initial idea was to have a comment inside the MySQL conditional like:</p>
  <pre><code>SELECT * FROM USERS
  WHERE id = /*! 4 or 1=1 --*/ MSSQL code that is ignored by mysql
  </code></pre>
  <p>But this throws an error saying to check my syntax at a line with nothing on it near ''.</p>
  <p>I don't fully understand why this doesn't work but I know doesn't work with any form of MySQL comment I know of (Tried #, /*).</p>
  <p>Is there a way to get my strange SQL statement to work?  Or is there a way to do a conditional comment in MSSQL?  I really just need MySQL to ignore anything after it's conditional but I have no idea how to make that happen without comments.</p>