title: SQL Injection even when escaping quote
body: <p>I'm trying to think of a way to get around the following, because it looks like someone did, and I want to fix it. But, I would really like to understand how the attack works before fixing it with something like <a href="https://www.owasp.org/index.php/Reviewing_Code_for_SQL_Injection" rel="nofollow">OWASP Recommendation</a></p>
  
  <pre><code>    Set conn = Server.CreateObject("ADODB.Connection")
      conn.open xDb_Conn_Str
      sSql = "SELECT * FROM [User]"
      sSql = sSql &amp; " WHERE [Username] = '" &amp; CleanSql(sUserId) &amp; "'"
      Set rs = conn.Execute(sSql)
  </code></pre>
  
  <p>CleanSql - </p>
  
  <pre><code>Function CleanSql(str)
  
      Dim sWrk
  
      sWrk = Trim(str&amp;"")
      sWrk = Replace(sWrk, "'", "''") ' Adjust for Single Quote
  
      sWrk = Replace(sWrk, "[", "[[]") ' Adjust for Open Square Bracket
  
      CleanSql = sWrk
  
  End Function
  </code></pre>
  
  <p>Single quote is obviously escaped in this.</p>
  
  <p>Right after this it will do a check if it finds the user to validate the password with the following:</p>
  
  <pre><code>If UCase(rs("Password")) = UCase(sPassWd) Then
      DoStuff()
  </code></pre>
  
  <p>Any help is appreciated.</p>