With SQL Server, does the ampersand pose as a threat related to SQL injection? I'm working on a project that includes this as a blacklisted character. I'm aware that there's a threat related to Oracle (SQL*Plus) but cannot seem to find an issue with the ampersand. I've referenced multiple cheat sheets and articles, and cannot find a reference to it (other than Oracle).


Technically yes, but no more so than any other T-SQL syntax. The & is used for bitwise actions, and if there is an applicable SQL injection vulnerability found, an attacker could use it to probe for more information about the structure of the query/data, but it's a very specialized scenario, and, in my opinion, a very low priority. I can think of many more reasons to whitelist an ampersand than I can to blacklist it.

See the link below for more documentation about the operator.


You can do the following:

You have to replace the ' by Chr(146). For example, in vb.net you can use string.Replace("'", Chr(146)).

SQL accepts chr(146), but not the chr(39).

  • How is this answer related to the question? Feb 27 '19 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.