Re: Evolve Merchant[ injection sql ]

[tony@xxxxxxxxxxxxxxxx]

We have fixed the (original)  viewcart.asp?zoneid  one, that was a legitimate 
sql injection hole.

The (other)  products.asp?pa rtno  is not a sql-injection vulnerability. 
However it does put up a sql error message if an unknown partno is passed. So 
the researcher would have put in an apostrophe into the partno, and seen the 
error appear and assumed it was a sql-injection hole. However the partno is 
actually escaped correctly, and the sql error is actually one step removed.