Sphinx,
After exhausting many possibilities for the Sql-injection challenge, I confered with quangntenemy who has passed it to see if I did indeed have the right answer. Sure enough, he confirmed that the answer I had come across was indeed the same as what he had used to pass the challenge. Additionally, he said that he encountered the same problem as I had with this answer, but when he tried the same answer a day later, it accepted it.
He thinks that it has to do with the fact that we both have long usernames. I've sent you an email with the answer I am speaking of. Can you check to see if this is a bug?
Thanks,
Andy