pentesting...hrmm, i can inject into a SQL LIKE clause with things like '_' and '%' to influence results, but can't quote-escape to exec raw