what is the meaning of select ''-'' - mysql

Question

There is an article about SQL injection: Abusing MySQL string arithmetic for tiny SQL injections
The question is, what is the meaning of select ''-'' ? I try it with MySQL, and it returns:
mysql> select ''-'';
+-------+
| ''-'' |
+-------+
| 0 |
+-------+
1 row in set (0.00 sec)
What happend? What means that 0?
And the result of select '-':
mysql> select '-';
+---+
| - |
+---+
| - |
+---+
1 row in set (0.00 sec)
I am very confused about these result.

Answer 1

You are minus - from one empty string '' to other:
See following:
mysql> select '';
+--+
| |
+--+
| |
+--+
1 row in set (0.00 sec)
mysql> select '3'-'2';
+---------+
| '3'-'2' |
+---------+
| 1 |
+---------+
1 row in set (0.00 sec)
But warning if its not a number string:
mysql> select 'a'-'b';
+---------+
| 'a'-'b' |
+---------+
| 0 |
+---------+
1 row in set, 2 warnings (0.00 sec)
Two warnings:
mysql> SHOW WARNINGS LIMIT 2
-> ;
+---------+------+---------------------------------------+
| Level | Code | Message |
+---------+------+---------------------------------------+
| Warning | 1292 | Truncated incorrect DOUBLE value: 'a' |
| Warning | 1292 | Truncated incorrect DOUBLE value: 'b' |
+---------+------+---------------------------------------+
2 rows in set (0.00 sec)
Why no warning for empty string?
Where as there is no warning for empty string because its(casted something) 0 see below:
mysql> SELECT 0 = '';
+--------+
| 0 = '' |
+--------+
| 1 |
+--------+
1 row in set (0.00 sec)
hence by doing ''-'' you are doing 0 - 0
mysql> SELECT '' - '';
+---------+
| '' - '' |
+---------+
| 0 |
+---------+
1 row in set (0.00 sec)
To be more clear I am adding following example (I feels will be helpful to you):
How conversion happen:
mysql> SELECT '0' = 0
-> ;
+---------+
| '0' = 0 |
+---------+
| 1 |
+---------+
1 row in set (0.00 sec)
notice its conversion:
mysql> SELECT '' = '0'
-> ;
+----------+
| '' = '0' |
+----------+
| 0 |
+----------+
1 row in set (0.00 sec)
'' converted into 0, '0' converted into 0 but '' not equals to '0'
mysql> SELECT '1' = 1
-> ;
+---------+
| '1' = 1 |
+---------+
| 1 |
+---------+
1 row in set (0.00 sec)
mysql> SELECT '' = 1
-> ;
+--------+
| '' = 1 |
+--------+
| 0 |
+--------+
1 row in set (0.00 sec)

Answer 2

I'd explain select ''-'', which is the same as select '' - '', as select cast('' as int) - cast('' as int) which is select 0-0..
With select '-' you just get a string. Hope that makes sense...

Answer 3

'' is an empty string; - is subtraction. So you're subtracting one empty string from another. Subtraction is a numeric operator, so its result is a number, and mysql converts its arguments into numbers before subtracting them. The numeric value of '' is zero — but it doesn't matter very much, since any number subtracted from itself is going to give zero anyway.