Microsoft SQL Server SQL Injection Through .NET Even With Quote Escaping
Single-quote escaping can be circumvented if there is a numeric field input that is not checked for only numeric data (and, as always, if the field isn't length limited.) Here's the basic method:

Enter a valid number, followed by a semicolon to terminate the existing command. Then enter something like below, after the semicolon - this will execute the command SELECT * FROM users;

DECLARE @o varchar(max);SELECT @o= CHAR(83)+CHAR(69)+CHAR(76)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(32)+CHAR(42)+ CHAR(32)+CHAR(70)+CHAR(82)+CHAR(79)+CHAR(77)+CHAR(32)+CHAR(117)+CHAR(115)+ CHAR(101)+CHAR(114)+CHAR(115)+CHAR(59);EXEC(@o);

Nowadays, having code that would allow this through your input field would be pretty unlikely - a simple IsNumeric() check would blow this right out of the water, and a rational fieldsize limit on the numeric input leaves you trying to execute DECLAR or some such, which will of course blow up. But this is theoretically possible.