User: ' or isnull(1/0) /*
Pass: whatever
Source: http://www.securityfocus.com/bid/14466/exploit
To find Silvernews site, just Googling with "allintext: powered by silvernews" keyword

Interesting, never seen one with that form before

Yeah, but are there any important improvements compared to the known Forms
(' or 1=1 and so on) ?

lol i cant eblive something this simple actually worked

I as well have never seen the " ' or isnull(1/0) /* " type used in an sql injection. I understand that isnull(1/0) evaluates to true but what is the /* used for?

the /* ends the execution of the sql query...that why you cant input whatever you want as password

lets say the query that is normaly executed is:

select * from blabla where username=x and password=y .....

by using the sql injection you change the query to

select * from blabla where username=' or 1=1 /*

1=1 is always true so it will select the first entrance in the db as the user(in this and many other cases=the admin)

and thats it,its one of the most simple methods of sql injection

Thats what I thought it was. I usually see it as a "--" (dash dash) but it all makes sense now. Thanks for the clarification.