Small setbacks when analyzing a piece of asp code with Injection Vulnerabilities

I saw a piece of code on the Internet: (I will explain the key part later)
<! -- # Include file = "../user/conn. asp" -->
<! -- # Include file = "Path. Asp" -->
<ASX version = "3.0">
<%
Id1 = replace (request ("id"), "", "") 'the replace function does not work in simple filtering.
If id1 <> "" then': determines whether id1 is null.
Set rs = server. createobject ("adodb. recordset ")
Id = id1
SQL = "select * from MusicList where id in (" & id & ")" 'to check whether it is null or not, the SQL syntax query is included.
Rs. open SQL, conn, 1, 3
Rs ("hits") = rs ("hits") + 1' the problem lies here. This sentence will be explained in detail later.
Rs. update
Songpath = rs ("song_path ")
If songpath = "" or IsNull (songpath) Then
The following sections do not have much to do with it, so we will not analyze it in detail.
Songpath = 1
End If
Select Case songpath
Case 1
Song_path = song_path1
Case 2
Song_path = song_path2
Case 3
Song_path = song_path3
Case 4
Song_path = song_path4
Case 5
Song_path = song_path5
Case 6
Song_path = song_path6
Case 7
Song_path = song_path7
End select
Song_path = song_path & rs ("Wma ")
--------------------- Some code is omitted
Looking at this code, I have learned asp. Isn't it obvious that no filtering injection is generated? Yes, I said there was an injection at a glance, But I carefully read it later ~, See this line
Rs ("hits") = rs ("hits") + 1
Rs. update
Note No, this sentence makes our union useless, because it cannot be written. Then we only need to construct a classic SQL statement. Let's look at my structure:
Id = 1) SQL and 1 in (1
We can inject records from the front and back guarantees and add our own SQL statements in the middle. Suppose the key table here is admin, and the field has password, username
You can write it like this:
Id = 1) and (select top 1 len (password) from admin) = 16 and 1 in (1
The above md5 encryption is usually used. When you run it, you can solve the problem by yourself, but you can't pay attention to it ~~~