Cmon, first of you RenePunk. You don't have any clue to do even basic injection (as you mentioned, you'd like to hack them with sql). Nvm about it. if this download script went public, let me explain some thing. _Division database in on the server, SQLVersion => 2008 r2. You would jump directiores, but you won't be able download .MDF files, .LDF files with that. (Me & proxy downloaded mstsc.exe from their windows to check which file extensions it do download. If somebody would pass MIME Extensions and 11 chars limit. Soo good luck. (Maybe eggplants from yahoo wouldn't watch this thread xd)