title: Escaping single quote on SQL injection
body: <p>Hello I am going through some SQL injection examples and I have the following scenario: </p>
  
  <p>In this example, aware of the risk of SQL injection, the developer decided to block single quotes ' by removing any single quote ' in the query. However, there is still a way to break out of the SQL syntax and inject arbitrary SQL.</p>
  
  <p>To do so, you need to think of the query:</p>
  
  <pre><code>SELECT * FROM users WHERE username='[username]' and password='[password]'
  </code></pre>
  
  <p>The problem here is that you cannot, in theory, break out of the single quotes ' since you cannot inject any quote. However, if you inject a back-slash \, the second ' in the query (the one supposed to finish the string [username] will be escaped and will be closed by the third one (the one supposed to start the string [password].</p>
  
  <p>Doesn't this mean that if I input a "\" on the username field it will automatically break the query? and look something like </p>
  
  <pre><code>SELECT * FROM users WHERE username='[username] and password=' ..
  </code></pre>
  
  <p>Am I missing something ? Should I provide the backslash in another way? </p>