How to do SQL injection on Oracle

Question

I'm doing an audit of a system, which the developers insist is SQL injection proof. This they achieve by stripping out the single-quotes in the login form - but the code behind is not parameterized; it's still using literal SQL like so:

username = username.Replace("'", "");
var sql = "select * from user where username = '" + username + "'";

Is this really secure? Is there another way of inserting a single quote, perhaps by using an escape character? The DB in use is Oracle 10g.

Answer 1

Maybe you can also fail them because not using bind variables will have a very negative impact on performance.

Answer 2

A few tips:
1- It is not necessarily the ' character that can be used as a quote. Try this:

select q'#Oracle's quote operator#' from dual;

2- Another tip from "Innocent Code" book says: Don't massage invalid input to make it valid (by escaping or removing). Read the relevant section of the book for some very interesting examples. Summary of rules are here.