Ayuda con SQL Injection

[noukeys]

Buenos días, y gracias a todos por la ayuda

El caso es que haciendo una sqlinjection me surge el siguiente caso:

Código [Seleccionar] Expandir


Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near the keyword 'UNION'. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23

Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23

Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23

Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23

Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23

Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23

Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23

Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23

Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23

Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near the keyword 'ORDER'. (severity 15) in D:\Sitios Web\html\includes\db.php on line 23

Warning: mssql_query() [function.mssql-query]: Query failed in D:\Sitios Web\html\includes\db.php on line 23

Warning: mssql_num_rows(): supplied argument is not a valid MS SQL-result resource in D:\Sitios Web\html\includes\db.php on line 24


El servidor tiene las magic-quotes activadas y claro, me escapa la ' del '--
he provado a hacer un +char(0x27)-- en la url, pero no funciona.

¿Alguien sabe como afrontar este problema?

MUCHÍIISIMAS GRACIAAAAAASSSS