So - hypothetically - the first result of the sample run at sqid.rubyforge.org would only yield a Microsoft OLE DB provider error (Unclosed quotation mark before the character string).
Now, granted, this is bad practice if they can't trap their errors, but I also don't see how this constitutes proof of an XSS vulnerability. The usual XSS variations - again, purely hypothetically - all just yield the same error message. Would you consider this a potential false positive then? In my opinion it's not a vuln unless it's exploitable.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
