Você pode gostar...
search\' order by 2829-- pclh
search union all select null-- gcog
dando pra varios
japanese doktor
search\' union all select null,null-- vcim
search\') union all select null,null,null,null,null-- lxtc
search waitfor delay \'0:0:5\'
search and 8504=dbms_pipe.receive_message(chr(87)||chr(66)||chr(105)||chr(84),5)