Let's assume we're building a SQL query like this:
SELECT * FROM users WHERE username = 'Username' AND password='password'
If we blocked the characters
', will an attacker be able to hack into it at all?
Here's my regex statement
/[\"\']/ and if there are any matches it will block the request. I'm also trying to avoid using MySQLi prepare.