Break the limit of the space _ Trojan related

About the space, there are many ways to replace, such as tab space, SQL database/**/, but I found another way to replace, has been published in the "Hacker Handbook" No. 2006.7, here to pick its essence, now!

For SQL statements, people are also accustomed to their spaces, such as select ID from [name], if there is no space between, it became a selectidfrom[name], a beach confused! In addition to the few whitespace alternatives mentioned above, I found that the () parentheses can be run in SQL, such as the above statement, which can be written as a select (ID) from[name], separated by parentheses, and can be performed normally.
For example, let's say we get an injection point: Jmdcw.asp?name=aa ' and 1=1 and ' = ' If you replace the statement where 1=1 is the password for the query administrator: (select ASC (mid pass,1,1) from [name] where id=1) >49. How do I use a space? In fact, it can be written like this:
Jmdcw.asp?name=aa ' and (SELECT (ASC (pass,1,1)) From[name]where (id=1)) >49) and ' = '
If the < and > symbols are blocked, use between...and ... and the statement is:
Jmdcw.asp?name=aa ' and (SELECT (ASC (pass,1,1)) From[name]where (id=1)) between (a) and ()) and ' = '

For places where spaces should appear in the middle, replace them with (), but not very useful for complex SQL statements. The above is the character type, if it is a numeric type, you can add a bracket after the id=1, but this I did not test, for example: jmdcw.asp?id= (1) and (select ...), should be feasible?

Oh, summed up, and Loveshell friends to share.