Thanks for including the screenshots. So now as you run your security test, look in the "Security Log" tab. As you double click on each of the requests, you can see what data was passed in and received.
"All at Once" setting will make sure that for 'lemail' and 'lticket' both values are set to the injection token - e.g. "' or '1'='1". Whereas the 'One by One' strategy would first set 'lemail' to "' or '1'='1" and then send another request where 'lticket' is "' or '1'='1".
Are you seen different behvaior?
Thanks,
Michael Giller
SmartBear Software
