SQL Injection Attack

All,
I am trying to test an attack against a web page. The VBScript runs 2
queries against the database; the first must succeed before the second
runs. Here is the code:

1st-
select * from users where (userid=' + @string + ') and password=' +
@pwdstring + '

2nd-
select * from permissions where userid=' + @string + '

When attempting the attack the problem lies in the "(" & ")"
surrounding the first userid string in the 1st query. if I attempt to
put a ")" in the original @string function to cancel out the first "("
it then causes problems for the second string. Also, the @pwdstring
gets encrypted before it is sent to the SQL Server, so attempting the
attack from that field is useless.

For instance:
@string = ' or 1=1)--
@pwdstring = blank (becomes @pwdstring = 55-12-567-3244-123 due to
encryption)

select * from users where (userid='' or 1=1)--') and
password='55-12-567-3244-123' WORKS OK
select * from permissions where userid='' or 1=1)--' DOES NOT WORK

Is this an instance where the original developers made a happy coding
error (I asked and preventing injection attacks wasn't intended) or is
there something I can do to circumvent this?

Thanks,
josh