Buenos días, y gracias a todos por la ayuda :D
El caso es que haciendo una sqlinjection me surge el siguiente caso:
Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near the keyword 'UNION'. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23
Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23
Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23
Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23
Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23
Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23
Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23
Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23
Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23
Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near the keyword 'ORDER'. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23
Warning: mssql_query() [function.mssql-query]: Query failed in D:\Sitios Web\html\includes\db.php on line 23
Warning: mssql_num_rows(): supplied argument is not a valid MS SQL-result resource in D:\Sitios Web\html\includes\db.php on line 24
El servidor tiene las magic-quotes activadas y claro, me escapa la ' del '--
he provado a hacer un +char(0x27)-- en la url, pero no funciona.
¿Alguien sabe como afrontar este problema?
MUCHÍIISIMAS GRACIAAAAAASSSS :D