# Rack Your Brains

**URL:** <https://forum.kirupa.com/t/rack-your-brains/225933>\
**Category:** programming\
**Created:** [May 16, 2007, 8:11pm UTC](https://forum.kirupa.com/t/rack-your-brains/225933 "2007-05-16T20:11:23Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yeldarb](https://avatars.discourse-cdn.com/v4/letter/y/51bf81/32.png) [@Yeldarb](https://forum.kirupa.com/u/Yeldarb)\
**Post date:** [May 16, 2007, 8:11pm UTC](https://forum.kirupa.com/t/rack-your-brains/225933/1 "2007-05-16T20:11:23Z")

</div>

Sorry for the non-descriptive title… couldn’t think of what to call this.

But here’s the deal. I have a client who purchased a closed-source PHP script. He wants a feature added, but the jack\*\*\* developer won’t let me edit the source to the script.

But, I’ve been able to find an exploit in the script that allows me to manipulate it. Unfortunately, I hit a road block.

I have a query in the form

```auto
SELECT * FROM table WHERE something=something_else AND data=$1

```

I can add stuff to the end, for instance

```auto
SELECT * FROM table WHERE something=something_else AND data=$1 OR data=$2

```

But I can’t add or remove anything in the middle.

What I want to be able to do is this

```auto
SELECT * FROM table WHERE something=something_else AND (data=$1 OR data=$2)

```

But since the AND operator takes precedence over the OR operator, I can’t figure out how to do it.

Anyone have any ideas?