` format).
+
+---
+
+## Suite layout
+
+`tests/hurl/` holds two suites:
+
+- `smoke/` and `functional/` — endpoint behaviour on a plain deployment.
+
+---
+
+## Running the functional suite (plain Docker / CI)
+
+The functional suite validates endpoint behaviour end-to-end:
+
+| File | Requests | What it covers |
+|------------------|----------|----------------|
+| `redirect.hurl` | 2 | SendRedirect: no-param→200+text/plain (#8 regression); param→302+Location |
+| `sql.hurl` | 5 | MySql_Get_int, MySql_Get_string, MySql_Get_Implicit_Join (benign + SQLi), MySql_Get_Union |
+| `xss.hurl` | 2 | customTag.jsp benign name; `` reflected unescaped |
+| `traversal.hurl` | 4 | FileInputStreamServlet01 benign TestFile; `../TestFile` traversal succeeds |
+| `negative.hurl` | 3 | 404 on unknown path; empty result set; no-param graceful 200 |
+
+```sh
+# Start the Docker MySQL stack
+docker compose -f docker-compose.mysql.yml up -d
+
+# Run functional tests
+./tests/hurl/run.sh functional localhost 8080
+
+# Or with hurl directly
+hurl --test --variables-file tests/hurl/functional/local.env \
+ tests/hurl/functional/*.hurl
+```
+
+**XSS note:** The ReadHTML-based servlets (`XSSWebAppHSRPW` etc.) do NOT reflect
+the `taintedtext` param because `xss.html` contains no literal `"XSS"` token.
+`customTag.jsp` is the GET-accessible reflected-XSS endpoint used here.
+
+---
+
+## Running the smoke suite (plain Docker / CI)
+
+The smoke suite validates:
+1. App root responds `200`
+2. `GET /spiracle/MySql_Get_string?name=Patrick` → `200`, body contains `Moss`
+3. SQLi payload widens the result set (body contains `Thomas`) → `200`
+
+```sh
+# Start the Docker MySQL stack
+docker compose -f docker-compose.mysql.yml up -d
+
+# Run smoke tests
+./tests/hurl/run.sh smoke localhost 8080
+
+# Or with hurl directly
+hurl --test --variables-file tests/hurl/smoke/local.env \
+ tests/hurl/smoke/smoke.hurl
+```
+
+Reports are written as JUnit XML to `/tmp/spiracle-{smoke,functional}-report/junit.xml`.
+Override with `REPORT_DIR=/path/to/dir ./tests/hurl/run.sh ...`.
+
+---
+
+## Hurl assertion form used
+
+`HTTP {{var}}` in the status line is **not** valid in Hurl 5.x.
+All files use the `[Asserts]` form:
+
+```
+HTTP *
+[Asserts]
+status == 200
+```
+
+This was verified against Hurl 5.0.1 before committing.
diff --git a/tests/hurl/functional/local.env b/tests/hurl/functional/local.env
new file mode 100644
index 0000000..0182d07
--- /dev/null
+++ b/tests/hurl/functional/local.env
@@ -0,0 +1,2 @@
+host=localhost
+port=8080
diff --git a/tests/hurl/functional/negative.hurl b/tests/hurl/functional/negative.hurl
new file mode 100644
index 0000000..4fd3108
--- /dev/null
+++ b/tests/hurl/functional/negative.hurl
@@ -0,0 +1,29 @@
+# negative.hurl — boundary and error cases.
+#
+# These cases verify that the app responds deterministically to invalid
+# or missing inputs, providing a stable baseline for regression.
+
+# ── 1. Non-existent servlet path → 404 ───────────────────────────────
+GET http://{{host}}:{{port}}/spiracle/NoSuchServletXYZ
+
+HTTP 404
+
+# ── 2. MySql_Get_string with unknown name → 200, empty results ───────
+# No rows match name='NoSuchUser99'; the app still returns 200 with an
+# empty result table (no error, no crash).
+GET http://{{host}}:{{port}}/spiracle/MySql_Get_string?name=NoSuchUser99
+
+HTTP 200
+[Asserts]
+body contains "Results"
+# App echoes param in SQL query preview but no | rows should appear
+body not contains " | NoSuchUser99 | "
+
+# ── 3. MySql_Get_int with no param → 200, empty results ─────────────
+# ParameterNullFix sanitises null to empty string; the SQL query
+# WHERE id = '' returns zero rows — app handles gracefully.
+GET http://{{host}}:{{port}}/spiracle/MySql_Get_int
+
+HTTP 200
+[Asserts]
+body contains "Results"
diff --git a/tests/hurl/functional/redirect.hurl b/tests/hurl/functional/redirect.hurl
new file mode 100644
index 0000000..57eede2
--- /dev/null
+++ b/tests/hurl/functional/redirect.hurl
@@ -0,0 +1,24 @@
+# redirect.hurl — regression tests for SendRedirect behaviour.
+#
+# Source: src/main/java/com/waratek/spiracle/misc/SendRedirect.java
+# @WebServlet("/SendRedirect")
+#
+# Regression for #8: when redirectMeTo param is absent the servlet must
+# respond 200 with Content-Type: text/plain and explain the missing param.
+# If the fix is reverted the Content-Type header will be missing/wrong.
+
+# ── 1. No param → 200 plain text with usage hint ─────────────────────
+GET http://{{host}}:{{port}}/spiracle/SendRedirect
+
+HTTP 200
+[Asserts]
+header "Content-Type" contains "text/plain"
+body contains "redirectMeTo"
+
+# ── 2. Valid param → 302 redirect to supplied URL ────────────────────
+# Hurl does NOT follow redirects by default; the 302 is directly observable.
+GET http://{{host}}:{{port}}/spiracle/SendRedirect?redirectMeTo=https://example.com
+
+HTTP 302
+[Asserts]
+header "Location" contains "example.com"
diff --git a/tests/hurl/functional/sql.hurl b/tests/hurl/functional/sql.hurl
new file mode 100644
index 0000000..4b519f0
--- /dev/null
+++ b/tests/hurl/functional/sql.hurl
@@ -0,0 +1,60 @@
+# sql.hurl — functional SQL tests against the unprotected MySQL stack.
+#
+# Sources:
+# MySql_Get_int → @WebServlet("/MySql_Get_int") param: id
+# MySql_Get_string → @WebServlet("/MySql_Get_string") param: name
+# MySql_Get_Implicit_Join → @WebServlet("/MySql_Get_Implicit_Join") param: id
+# MySql_Get_Union → @WebServlet("/MySql_Get_Union") param: id
+#
+# Seed data (setupdb_mysql.sql):
+# id=1 → Patrick Moss
+# id=2 → Margaret Thomas
+# address id=1 → 2128 Vestibulum, St. / Dubuisson / San Marino
+
+# ── 1. MySql_Get_int benign: id=1 returns Patrick Moss ───────────────
+GET http://{{host}}:{{port}}/spiracle/MySql_Get_int?id=1
+
+HTTP 200
+[Asserts]
+body contains "Patrick"
+body contains "Moss"
+
+# ── 2. MySql_Get_string benign: name=Patrick returns surname Moss ────
+GET http://{{host}}:{{port}}/spiracle/MySql_Get_string?name=Patrick
+
+HTTP 200
+[Asserts]
+body contains "Moss"
+
+# ── 3. MySql_Get_Implicit_Join benign: id=1 returns row + address ────
+# Query: SELECT * FROM users, address WHERE users.id = 1 AND users.id = address.id
+# Proves the join works for a known row.
+GET http://{{host}}:{{port}}/spiracle/MySql_Get_Implicit_Join?id=1
+
+HTTP 200
+[Asserts]
+body contains "Patrick"
+body contains "Dubuisson"
+
+# ── 4. Unprotected SQL injection on MySql_Get_Implicit_Join ──────────
+# Payload: id=1 OR 1=1
+# Query becomes: SELECT * FROM users, address WHERE users.id = 1 OR 1=1 AND users.id = address.id
+# This executes and returns ALL users.
+# id=1 only returns Patrick Moss; injection adds Margaret Thomas (id=2).
+# Asserting both surnames proves injection executed and widened the result.
+GET http://{{host}}:{{port}}/spiracle/MySql_Get_Implicit_Join?id=1%20OR%201%3D1
+
+HTTP 200
+[Asserts]
+body contains "Moss"
+body contains "Thomas"
+
+# ── 5. MySql_Get_Union benign: id=1 returns user + address rows ──────
+# Query: SELECT name,surname,dob FROM users ... UNION SELECT address_1,address_2,address_3 FROM address ...
+# Both result sets for id=1 are returned.
+GET http://{{host}}:{{port}}/spiracle/MySql_Get_Union?id=1
+
+HTTP 200
+[Asserts]
+body contains "Moss"
+body contains "Dubuisson"
diff --git a/tests/hurl/functional/traversal.hurl b/tests/hurl/functional/traversal.hurl
new file mode 100644
index 0000000..4642640
--- /dev/null
+++ b/tests/hurl/functional/traversal.hurl
@@ -0,0 +1,39 @@
+# traversal.hurl — path traversal demonstration (unprotected).
+#
+# Source: src/main/java/com/waratek/spiracle/path_traversal/FileInputStreamServlet01.java
+# @WebServlet("/FileInputStreamServlet01") param: FileInputStream01
+#
+# The servlet constructs:
+# absolutePathToTestFile = /pathTraversal/testFilesParent/testFilesChild/
+# + File.separator + FileInputStream01
+# No sanitisation is applied. A "../" sequence traverses up one directory.
+# The servlet stores "File input stream opened for file: ''" in the
+# session, then redirects to pathTraversal.jsp which renders it.
+# Hurl follows the redirect automatically (session cookie carried).
+#
+# Known test files in the deployment:
+# testFilesChild/TestFile (the intended target)
+# testFilesParent/TestFile (one level up — requires traversal)
+
+# ── 1. Benign: access known file in testFilesChild ───────────────────
+GET http://{{host}}:{{port}}/spiracle/FileInputStreamServlet01?FileInputStream01=TestFile
+[Options]
+location: true
+
+HTTP 200
+[Asserts]
+body contains "File input stream opened for file:"
+body contains "testFilesChild"
+
+# ── 2. Path traversal: ../TestFile escapes testFilesChild ────────────
+# %2F = / so ../TestFile URL-encodes to ..%2FTestFile
+# The constructed path resolves to testFilesParent/TestFile.
+# The traversal is NOT blocked and the stream opens.
+GET http://{{host}}:{{port}}/spiracle/FileInputStreamServlet01?FileInputStream01=..%2FTestFile
+[Options]
+location: true
+
+HTTP 200
+[Asserts]
+body contains "File input stream opened for file:"
+body contains "testFilesParent"
diff --git a/tests/hurl/functional/xss.hurl b/tests/hurl/functional/xss.hurl
new file mode 100644
index 0000000..232247a
--- /dev/null
+++ b/tests/hurl/functional/xss.hurl
@@ -0,0 +1,28 @@
+# xss.hurl — reflected XSS demonstration (unprotected).
+#
+# Source: src/main/webapp/customTag.jsp
+# The JSP reads request.getParameter("name") and passes it to HelloUserTag,
+# which writes: Hello Spiracle user: NAME!
+# No escaping is applied, so a script payload in "name" is reflected verbatim.
+#
+# Note: the ReadHTML-based XSS servlets (XSSWebAppHSRPW, XSSWebAppSRPW etc.)
+# do NOT reflect the param because xss.html contains no literal "XSS" token
+# to substitute — they are not reflection endpoints.
+# customTag.jsp is the cleanest GET-accessible reflected-XSS endpoint.
+
+# ── 1. Benign name: confirm normal reflection ────────────────────────
+GET http://{{host}}:{{port}}/spiracle/customTag.jsp?name=Alice
+
+HTTP 200
+[Asserts]
+body contains "Hello Spiracle user"
+body contains "Alice"
+
+# ── 2. XSS payload reflected unescaped ──────────────────────────────
+# %3Cscript%3Ealert%281%29%3C%2Fscript%3E =
+# Without sanitisation the raw tag appears in the HTML body.
+GET http://{{host}}:{{port}}/spiracle/customTag.jsp?name=%3Cscript%3Ealert%281%29%3C%2Fscript%3E
+
+HTTP 200
+[Asserts]
+body contains ""
diff --git a/tests/hurl/run.sh b/tests/hurl/run.sh
new file mode 100755
index 0000000..9dbde9c
--- /dev/null
+++ b/tests/hurl/run.sh
@@ -0,0 +1,65 @@
+#!/bin/sh
+# run.sh — Spiracle Hurl test runner
+#
+# Usage:
+# ./tests/hurl/run.sh smoke [host] [port]
+# ./tests/hurl/run.sh functional [host] [port]
+#
+# Arguments:
+# suite — "smoke" or "functional"
+# host — hostname/IP of Spiracle (default: localhost)
+# port — TCP port (default: 8080)
+#
+# Requirements:
+# hurl v5+ at ~/.local/bin/hurl or on PATH
+
+set -eu
+
+SUITE="${1:-smoke}"
+HOST="${2:-localhost}"
+PORT="${3:-8080}"
+
+# Resolve hurl binary
+HURL=""
+if command -v hurl >/dev/null 2>&1; then
+ HURL="hurl"
+elif [ -x "$HOME/.local/bin/hurl" ]; then
+ HURL="$HOME/.local/bin/hurl"
+else
+ echo "ERROR: hurl not found. Install from https://hurl.dev" >&2
+ exit 1
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+case "$SUITE" in
+ smoke)
+ VARS_FILE="$SCRIPT_DIR/smoke/local.env"
+ FILES="$SCRIPT_DIR/smoke/smoke.hurl"
+ REPORT_DIR="${REPORT_DIR:-/tmp/spiracle-smoke-report}"
+ ;;
+ functional)
+ VARS_FILE="$SCRIPT_DIR/functional/local.env"
+ FILES="$SCRIPT_DIR/functional/redirect.hurl $SCRIPT_DIR/functional/sql.hurl $SCRIPT_DIR/functional/xss.hurl $SCRIPT_DIR/functional/traversal.hurl $SCRIPT_DIR/functional/negative.hurl"
+ REPORT_DIR="${REPORT_DIR:-/tmp/spiracle-functional-report}"
+ ;;
+ *)
+ echo "ERROR: unknown suite '$SUITE'. Use 'smoke' or 'functional'." >&2
+ exit 1
+ ;;
+esac
+
+mkdir -p "$REPORT_DIR"
+
+echo "Running Spiracle $SUITE suite against http://$HOST:$PORT"
+echo "Report: $REPORT_DIR/junit.xml"
+echo ""
+
+# shellcheck disable=SC2086
+$HURL \
+ --test \
+ --variables-file "$VARS_FILE" \
+ --variable host="$HOST" \
+ --variable port="$PORT" \
+ --report-junit "$REPORT_DIR/junit.xml" \
+ $FILES
diff --git a/tests/hurl/smoke/local.env b/tests/hurl/smoke/local.env
new file mode 100644
index 0000000..0182d07
--- /dev/null
+++ b/tests/hurl/smoke/local.env
@@ -0,0 +1,2 @@
+host=localhost
+port=8080
diff --git a/tests/hurl/smoke/smoke.hurl b/tests/hurl/smoke/smoke.hurl
new file mode 100644
index 0000000..24923b2
--- /dev/null
+++ b/tests/hurl/smoke/smoke.hurl
@@ -0,0 +1,31 @@
+# Spiracle smoke suite.
+#
+# Purpose: prove the app is up, DB round-trips work, and that SQLi is
+# not blocked: Tomcat returns 200 for valid SQL injections and 500 for
+# malformed ones.
+
+# ── 1. App root is reachable ─────────────────────────────────────────
+GET http://{{host}}:{{port}}/spiracle/
+
+HTTP 200
+
+# ── 2. Benign query returns the expected row ─────────────────────────
+# Patrick Moss is id=1, name='Patrick' in the seed data.
+# MySql_Get_string queries by name and returns the surname.
+GET http://{{host}}:{{port}}/spiracle/MySql_Get_string?name=Patrick
+
+HTTP 200
+[Asserts]
+body contains "Moss"
+
+# ── 3. SQL injection succeeds unprotected ───────────────────────────
+# The injection is NOT blocked.
+# The payload ' OR '1'='1 widens the WHERE clause to match all rows.
+# Margaret Thomas (id=2) is NOT in the result set for name='Patrick',
+# but WILL appear when the injection succeeds. Asserting her surname
+# proves more rows were returned than the benign query would give.
+GET http://{{host}}:{{port}}/spiracle/MySql_Get_string?name=Patrick'%20OR%20'1'='1
+
+HTTP 200
+[Asserts]
+body contains "Thomas"
diff --git a/tests/mysql.txt b/tests/mysql.txt
deleted file mode 100644
index c4ecf66..0000000
--- a/tests/mysql.txt
+++ /dev/null
@@ -1,139 +0,0 @@
-/spiracle/MySql_Get_int?id=2' OR name LIKE '%25'--550
-/spiracle/MySql_Get_int?id=1' || name like '%25'--550
-/spiracle/MySql_Get_int?id=1' or users.name LIKE '%25'--550
-/spiracle/MySql_Get_int?id=1' or id like '%25550
-/spiracle/MySql_Get_int?id=1' OR 100=(SELECT COUNT(*) FROM users) --550
-/spiracle/MySql_Get_int?id=1' OR users.cvv IS NULL --550
-/spiracle/MySql_Get_int?id=1' AND DOB IS NULL --550
-/spiracle/MySql_Get_int?id=1' OR cvv IS NULL --550
-/spiracle/MySql_Get_int?id=1' OR 'x'='x'--550
-/spiracle/MySql_Get_int?id=1' or 1=1 or 'x'='y'--550
-/spiracle/MySql_Get_int?id=1' UNION ALL SELECT * from users where id=1 or 1=1 --550
-/spiracle/MySql_Get_int?id=1' or 1=1 or ''=''--550
-/spiracle/MySql_Get_int?id=' or 1=1 or ''=''--550
-/spiracle/MySql_Get_int?id=("hi")' or ('a'='a')--550
-/spiracle/MySql_Get_int?id=a' or 'a' = 'a'--550
-/spiracle/MySql_Get_int?id=joe' or '1'='1'--550
-/spiracle/MySql_Get_int?id=1' UNION SELECT * from users where id=1 or 1=1--550
-/spiracle/MySql_Get_int?id=hi' or 1=1--550
-/spiracle/MySql_Get_int?id=hi' or 'a'='a'--550
-/spiracle/MySql_Get_int?id=a' or 1=1--550
-/spiracle/MySql_Get_int?id=%27%20or%20'x'='x'--550
-/spiracle/MySql_Get_int?id=' or 0=0 --550
-/spiracle/MySql_Get_int?id=a' or 3=3--550
-/spiracle/MySql_Get_int?id=Joe' or 0=0 --550
-/spiracle/MySql_Get_int?id=Joe' or 'a'='a'--550
-/spiracle/MySql_Get_int?id=1' or ''=''--550
-/spiracle/MySql_Get_int?id=' or 1=1--550
-/spiracle/MySql_Get_int?id='%20or%201=1--550
-/spiracle/MySql_Get_int?id=%27%20or%201=1--550
-/spiracle/MySql_Get_int?id=' or 3=3--550
-/spiracle/MySql_Get_string?name=x' or name like '%25'--550
-/spiracle/MySql_Get_string?name=%3C%3E%22%2527%25%3B)(%26%2B200
-/spiracle/MySql_Get_string?name=x' AND 100=(SELECT COUNT(*) FROM address) --550
-/spiracle/MySql_Get_string?name=x' OR cvv IS NULL--550
-/spiracle/MySql_Get_string?name=anything' OR 'x'='x550
-/spiracle/MySql_Get_string?name=x' or 1=1 or 'x'='y550
-/spiracle/MySql_Get_string?name=' UNION ALL SELECT * from users where id=1 or 1=1--550
-/spiracle/MySql_Get_string?name='or 1=1 or ''='550
-/spiracle/MySql_Get_string?name=a' or 'a' = 'a550
-/spiracle/MySql_Get_string?name=' or '1'='1'--550
-/spiracle/MySql_Get_string?name=' UNION SELECT * from users--550
-/spiracle/MySql_Get_string?name=a' or 1=1--550
-/spiracle/MySql_Get_string?name=%27%20or%20%27x%27=%27x550
-/spiracle/MySql_Get_string?name='or 0=0 --550
-/spiracle/MySql_Get_string?name=a' or 3=3--550
-/spiracle/MySql_Get_string?name=' or 1=1--550
-/spiracle/MySql_Get_string?name=' or 1 --'550
-/spiracle/MySql_Get_string?name=' or 'a'='a'--550
-/spiracle/MySql_Get_string?name=%27%20or%201=1--550
-/spiracle/MySql_Get_string?name=x' or 3=3--550
-/spiracle/Get_Union?id='2' OR 'name' LIKE 'Joe'550
-/spiracle/Get_Union?id='1' or 'name' like 'Joe'550
-/spiracle/Get_Union?id='1' or id like 1550
-/spiracle/Get_Union?id='1' or 'name' like'Joe'550
-/spiracle/Get_Union?id='1' OR 120=(SELECT COUNT(*) FROM users)550
-/spiracle/Get_Union?id='1' AND 'users.cvv' IS NULL550
-/spiracle/Get_Union?id='1' AND 'DOB' IS NULL550
-/spiracle/Get_Union?id='1' AND 'cvv' IS NULL550
-/spiracle/Get_Union?id='1' OR 'x'='x'550
-/spiracle/Get_Union?id='1' or 1=1 or 'x'='y'550
-/spiracle/Get_Union?id='1' or 1=1 or ''=''--550
-/spiracle/Get_Union?id=' or 1=1 or ''=''--550
-/spiracle/Get_Union?id='("hi")' or ('a'='a')--550
-/spiracle/Get_Union?id='a' or 'a' = 'a'550
-/spiracle/Get_Union?id='joe' or '1'='1'550
-/spiracle/Get_Union?id='hi' or 1=1--550
-/spiracle/Get_Union?id='hi' or 'a'='a'--550
-/spiracle/Get_Union?id='a' or 1=1--550
-/spiracle/Get_Union?id=''%20or%20'x'='x'--550
-/spiracle/Get_Union?id='' or 0=0 --550
-/spiracle/Get_Union?id='a' or 3=3--550
-/spiracle/Get_Union?id='Joe' or 0=0 --550
-/spiracle/Get_Union?id='Joe' or 'a'='a'--550
-/spiracle/Get_Union?id=1 or 'a'='a'550
-/spiracle/Get_Union?id=1 or '1'='1'550
-/spiracle/Get_Union?id=' or 1=1--550
-/spiracle/Get_Union?id=%27%20or%201=1--550
-/spiracle/Get_Union?id=' %20or%201=1--550
-/spiracle/Get_Union?id=' or 3=3--550
-/spiracle/MySql_Get_Implicit_Join?id='2' OR 'name' LIKE 'Joe'550
-/spiracle/MySql_Get_Implicit_Join?id='1' or 'name' like 'Joe'550
-/spiracle/MySql_Get_Implicit_Join?id='1' or users.id like 1550
-/spiracle/MySql_Get_Implicit_Join?id='1' or 'users.name' like'Joe'550
-/spiracle/MySql_Get_Implicit_Join?id='1' OR 120=(SELECT COUNT(*) FROM users)550
-/spiracle/MySql_Get_Implicit_Join?id='1' AND 'users.cvv' IS NULL550
-/spiracle/MySql_Get_Implicit_Join?id='1' AND 'DOB' IS NULL550
-/spiracle/MySql_Get_Implicit_Join?id='1' AND 'cvv' IS NULL550
-/spiracle/MySql_Get_Implicit_Join?id='1' OR 'x'='x'550
-/spiracle/MySql_Get_Implicit_Join?id='1' or 1=1 or 'x'='y'550
-/spiracle/MySql_Get_Implicit_Join?id='1' or 1=1 or ''=''--550
-/spiracle/MySql_Get_Implicit_Join?id='' or 1=1 or ''=''--550
-/spiracle/MySql_Get_Implicit_Join?id=('hi') or ('a'='a')550
-/spiracle/MySql_Get_Implicit_Join?id='a' or 'a' = 'a'550
-/spiracle/MySql_Get_Implicit_Join?id='joe' or '1'='1'550
-/spiracle/MySql_Get_Implicit_Join?id='hi' or 1=1--550
-/spiracle/MySql_Get_Implicit_Join?id='hi' or 'a'='a'--550
-/spiracle/MySql_Get_Implicit_Join?id='a' or 1=1--550
-/spiracle/MySql_Get_Implicit_Join?id=''%20or%20'x'='x'--550
-/spiracle/MySql_Get_Implicit_Join?id='' or 0=0 --550
-/spiracle/MySql_Get_Implicit_Join?id='a' or 3=3--550
-/spiracle/MySql_Get_Implicit_Join?id='Joe' or 0=0 --550
-/spiracle/MySql_Get_Implicit_Join?id='Joe' or 'a'='a'--550
-/spiracle/MySql_Get_Implicit_Join?id=1 or 'a'='a'550
-/spiracle/MySql_Get_Implicit_Join?id=1 or '1'='1'550
-/spiracle/MySql_Get_Implicit_Join?id=1 or '1'='1'550
-/spiracle/MySql_Get_Implicit_Join?id='' or 1=1--550
-/spiracle/MySql_Get_Implicit_Join?id='' %20or%201=1--550
-/spiracle/MySql_Get_Implicit_Join?id='' or 3=3--550
-/spiracle/MySql_Get_Implicit_Join?id=%27%27%20or%201=1--550
-/spiracle/MySql_Implicit_Join_Namespace?id='2' OR 'name' LIKE 'Joe'550
-/spiracle/MySql_Implicit_Join_Namespace?id='1' or 'name' like 'Joe'550
-/spiracle/MySql_Implicit_Join_Namespace?id='1' or users.id like 1550
-/spiracle/MySql_Implicit_Join_Namespace?id='1' or 'users.name' like'Joe'550
-/spiracle/MySql_Implicit_Join_Namespace?id='1' OR 120=(SELECT COUNT(*) FROM users)550
-/spiracle/MySql_Implicit_Join_Namespace?id='1' AND 'users.cvv' IS NULL550
-/spiracle/MySql_Implicit_Join_Namespace?id='1' AND 'DOB' IS NULL550
-/spiracle/MySql_Implicit_Join_Namespace?id='1' AND 'cvv' IS NULL550
-/spiracle/MySql_Implicit_Join_Namespace?id='1' OR 'x'='x'550
-/spiracle/MySql_Implicit_Join_Namespace?id='1' or 1=1 or 'x'='y'550
-/spiracle/MySql_Implicit_Join_Namespace?id='1' or 1=1 or ''=''--550
-/spiracle/MySql_Implicit_Join_Namespace?id='' or 1=1 or ''=''--550
-/spiracle/MySql_Implicit_Join_Namespace?id=('hi') or ('a'='a')550
-/spiracle/MySql_Implicit_Join_Namespace?id='a' or 'a' = 'a'550
-/spiracle/MySql_Implicit_Join_Namespace?id='joe' or '1'='1'550
-/spiracle/MySql_Implicit_Join_Namespace?id='hi' or 1=1--550
-/spiracle/MySql_Implicit_Join_Namespace