I'm doing some hacking courses, and in one of the lessons, I have a possible SQLi, but in the Python source code there's an if clause just before the SQL statement, which filters the quote symbol:
user="user" pass="pass" if "'" in user+pass: print "error" else: db.execute("select * from users where username = '%s' and password = '%s'" % (username,password))
So when I try to inject
asdf' or '1'='1 into any of the fields, the if clause stops me. I have tried to encode the quote symbol in different encodings (hex, base64, html, etc.), but it still does not work.