About this question
I found a simple breakout in a where clause in one of our projects where the code is so old that they claim they can't use parameters to communicate with ms SQL server. It's written in C++, I can't read this language and I'm not able to access the code in any way. To illustrate the issue I added an example of a non harmful statement, the bold part is what the user can directly input SELECT '1 ' SELECT 2--';
The single quote after 1 is causing the breakout in this scenario. This is what I've shown to the team. They then did a detection in code that searches for single quotes and add three other single quotes after each single quote they find. Thus the example would become this SELECT '1'''' SELECT 2--'; I don't like this solution at all, but I can't find a way to breakout any more. The fields inside the database are stored treated as nvarchar characters. Is there still a possibility to bypass this practice in any kind? How do SQL server escape single quote?
