Major bug fix to make partial UNION query sql injection work properly

also on Microsoft SQL Server