Is SQL Injection Possible without double and single quotes?

Question

Let's assume we're building a SQL query like this:
SELECT * FROM users WHERE username = 'Username' AND password='password'
If we blocked the characters " and ', will an attacker be able to hack into it at all?

Here's my regex statement /[\"\']/ and if there are any matches it will block the request. I'm also trying to avoid using MySQLi prepare.

Answer 1

Yes.

There are other ways to get data from a database, or just do something malicious. One way of doing this is to select all the records from the database, using either SELECT * FROM TABLE users or SELECT * FROM TABLE users WHERE True and then filtering through the returned data to find the user that the attacker wanted.

Further, statements like DROP TABLE users are not caught under the double quotes system, and have pretty nasty effects.