hi

I found an injection but there is some magic filtering. here is the code:

select * from someTable where someColumn LIKE 'INJECTION_HERE' ORDER BY someColumn DESC LIMIT INJECTION_2_HERE, 6

filtering is that
" turns into \\"
' turns into \\\'
\ turns into \\
Other than that, there is no filtering. can this site be owned?
thanks a lot



Edited 1 time(s). Last edit at 02/10/2009 12:38AM by reconsider.

I let injection_2 be
3,3;select SLEEP(30);select * from someTable order by someColumn DESC LIMIT 3

but I get error at or near ';select SLEEP(30);...' at line 5

as far as I know you can't stack queries... try UNION