I found a simple breakout in a where clause in one of our projects where the code is so old that they claim they can't use parameters to communicate with ms SQL server. It's written in C++, I can't read this language and I'm not able to access the code in any way.
To illustrate the issue I added an example of a non harmful statement, the bold part is what the user can directly input
SELECT '1 ' SELECT 2--';
The single quote after 1 is causing the breakout in this scenario. This is what I've shown to the team.
They then did a detection in code that searches for single quotes and add three other single quotes after each single quote they find. Thus the example would become this
SELECT '1'''' SELECT 2--';
I don't like this solution at all, but I can't find a way to breakout any more. The fields inside the database are stored treated as nvarchar characters. Is there still a possibility to bypass this practice in any kind?