Is there some way to inject SQL even if the ' character is deleted?

Question

If I remove all the ' characters from a SQL query, is there some other way to do a SQL injection attack on the database?

How can it be done? Can anyone give me examples?

Answer 1

Yes, there is. An excerpt from Wikipedia

"SELECT * FROM data WHERE id = " + a_variable + ";"

It is clear from this statement that the author intended a_variable to be a number correlating to the "id" field. However, if it is in fact a string then the end user may manipulate the statement as they choose, thereby bypassing the need for escape characters. For example, setting a_variable to

1;DROP TABLE users

will drop (delete) the "users" table from the database, since the SQL would be rendered as follows:

SELECT * FROM DATA WHERE id=1;DROP TABLE users;

SQL injection is not a simple attack to fight. I would do very careful research if I were you.