sqli hints On black box test : sometimes comments don't work. Always search a payload without comment (ie: "' or ''='") https://sqlwiki.netspi.com/attackQueries/dataTargeting/