« first day (2096 days earlier)      last day (562 days later) » 

9:52 AM
I research about SQL injection and the most common way to prevent it to use SQLParameter.

In short, The query should be

SELECT * FROM Table WHERE Column=@parameter;

but I found that wrapping a user input into a single quote (') like below prevent the SQL injection

SELECT * FROM Table WHERE Column='User Input ';
I may have misunderstand some concept since if a simple thing like wrapping a user input into a single quote works, why does people suggest SQLParameter?
I was hopping if someone could correct my misunderstanding and provide some sql injection script to test it (if possible) ?
 
 
8 hours later…
5:25 PM
@SunMaungOo That doesn't prevent SQL injection - the user can break your query by inputting a single quote of their own (or other characters)
What if the user input ' OR admin = true OR 1 = '?
People advocate for using parameters because it lets the library handle properly escaping the user input for you.
 

« first day (2096 days earlier)      last day (562 days later) »