security - How can sanitation that escapes single quotes be defeated by SQL injection in SQL Server? -

To turn this off, I know well that the parameterized queries are the best option, but I'm asking that the strategy What is I weighed down people say that the following solution is not working, so why am I not looking for an example that I will not do it.

If dynamic SQL is created in the code using the following escape before being sent to a SQL Server, what type of injection can beat it?

  string user input = "n" + user input. A similar question was answered, but I believe that no answer is applicable here. "(", "'' '' '' '' '' '' ''" "  
  
 It is not possible to avoid single quotes with "\" in SQL Server.  
 I believe that  SQL smelting  with Unicode (underlined) will fail from the fact that the string is being produced, before the single bid, the form of Unicode by N Has been marked in. As far as I know, there is no other character set that the SQL Server will automatically translate into a single quote. Without an incomplete single quote, I do not believe that injection is possible.  
 I do not believe that  string transformation  is a viable vector, the SQL server will definitely not be deducted because the maximum size for a  nvarchar  is 2GB  
  Second order injection  may be possible, but this is possible if:  
 
 All data going to the database using the above method Is limited to  
 Never assume the value from the database in dynamic SQL (Why do you ever do this, when you can only reference the table value, the static portion of any dynamic SQL string?).   
 I am not suggesting that it is better to use queries with parameters or to have an option, but I want to know what I have underlined is weak. Any ideas?   
 
 
 There are some cases where the escape function will fail. The most obvious is that when a single bid is not used:  
  string table = "\" "+ table.Replace (" ',' '') + "\" " ("'", "'") + "" String = query "=" `" + var.Replace ("'", "' ') +" `' string index =" "+ index. In this case, you can double-quotes, one back, from "+ + + + +" to `` where name = \ "" + var + "\" or id = "+ index   
 -Tick In the previous case there is nothing to "break out", so you can simply select the  1 union password from the users. They are -  or whatever the SQL payload the wisest wishes of the attacker  
 The next condition where this escape function will fail, if a sub-string is taken after the string (and  Yes  I have found vulnerability in such forests: ("'", "'") Username = substr (username, 0, 10) string query = "Select from users * = '"+ Username +"' and password = '"+" user password "; In this case, the user name of  abcdefgji ' will be changed by escape function in  abcdefgji' ' and then  ABCDFGG'  By taking the sub string It can be used by setting the password value in any sql statement, in this case  or 1 = 1 -  will be defined as SQL and the username will be defined as  abcdefgji "and the password Will be explained in the form = . The result is as follows:  
  Select from users where name = 'abcdefgji' and password = 'or 1 = 1--   
 T-SQL and other advanced SQL injection techniques where already mentioned. There is a great paper and you should read it if you do not already have  
 The final issue is Unicode attacks arises due to this class of weaknesses because the escape function is not aware of multi-byte encoding, and it It may not help in the formation of "N" in the string, because it does not affect the value of multi-byte characters later in the string. However, this type of attack is very unusual Because the database must be configured to accept GBK Unicode string (and I can not believe that MS-SQL).  
 Second-order code injection is still possible, the pattern of this attack is built on relying on attacker-controlled data sources. The escape is used to express control characters as their character. If the developer forgets to avoid the price obtained from any  select  and then uses this value in any other query, then the attacker at the  Bam  The letter will literally be a single quote. / P> 
  Check everything, do not trust anything.