Re: SQL injection question

[".Saphyr" <saphyr () infomaniak ch>]

: i tried to use %20, \20 etc.. but it don't seems to
: work

If your target is a mssql server, if you need spaces into your string
requests you can still use the SPACE function: 

SELECT * FROM users WHERE username = 'John'+SPACE(2)+'McLane'

What do you precisely need spaces for ?

Did you try simply using the '+' sign ?

.merlin



---------------------------------------------------------------------------
----------------------------------------------------------------------------