title: A string with Letter and Number only can inject SQL statement
body: <p>I am new to SQL injection and read some article, many hackers may use ';' and space ' 'in their input, for example:</p>
  
  <p>(1) username = '123;drop table account'</p>
  
  <p>(2) username = '123 and 1=1'</p>
  
  <p>But the question is, if we only allow user to type letter (both upper and lower case) and number on client side, no any other character like space, semicolon is allowed, is there any string exists can inject SQL statement?? If so, can anyone give me an example? Thanks!</p>
  
  <p>please note that I don't ask if client side can prevent SQL injection, I just wonder if such string with letter and number only exists to do SQL injection.</p>