sql injection with order by

From: dietf dietf (dietf_at_yahoo.com)
Date: 04/08/05

  • Next message: szynkro_at_gmail.com: "Rogue AP Wireless on Windows/Linux" 
    Date: 8 Apr 2005 03:52:02 -0000
To: pen-test@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Hi all,
    I am trying to make an injection with the statement below,

    SQL = "SELECT ProID, CusID, Name FROM ProTur WHERE Lan=0 AND CusID='%Customer%' ORDER BY Sira, ProjeTurID"

    in the statement above I inject ")select @@version-- for the variable Customer. But unless I have ended inject code with -- nothing happens.
    I get
    SQL = "SELECT ProID, CusID, Name FROM ProTur WHERE Lan=0 AND FirmaID=")select @@version-- ORDER BY Sira, ProjeTurID"
    what is the problem? can anybody tell me?
    Is the problem occurs from the word ORDER BY?
    Thanks

  • Next message: szynkro_at_gmail.com: "Rogue AP Wireless on Windows/Linux"