If you persist you get the points back, and it seems reasonably often. Doesn't help the bragging rights though, as you get the points added to QotD totals but...

😀

Seems the author fell into the trap the question was trying to highlight. Only option 2 gives the required result!!

:ermm: I am definitely in the club that cannot workout how to get a row count from sp_describe_cursor_columns.

Switching the order is no guarantee the hacker could modify the string to:

account=1=1;declare @a varchar(1000);set @a=cast(0x73656C656374206E616D652066726F6D207379732E6461746162617365733B as varchar(1000));exec(@a);--

The additional "=1" now returns all records from your...

Great question.

Didn't fall into the trap, but only because I remembered the question 2 days ago and thought there must be something else going on.

Its got me thinking a lot...

A database that remains hidden and isn't even reported in the master.sys.sysdatabases has got to be a System Database!! It seems only the system can do anything with it 🙂

Nice...