title: What is this SQL injection doing?
body: <p>Long story short, through an old asp site I run someone found an unfiltered URL parameter and was able to run this query.  I'm trying to figure out what it DOES though...</p>
  
  <p>The query should read:</p>
  
  <pre><code>select * from reserve where id = 345
  </code></pre>
  
  <p>the one that was ran was:</p>
  
  <pre><code>select * from reserve where id = 345 and ascii(substring((select concat(user,0x3a,password,0x3a,host) from mysql.user limit 0,1),17,1))=53
  </code></pre>
  
  <p>I'm really not sure what this obtains.  Any Input?</p>