The SQL phrase looks like this,
"SELECT * from XX where id = '" + id + "'"
id variable comes directly from the
GET parameter named
And the Java web app explicitly disallowed single quote. If a single quote was found in that parameter, the server stop processing it immediately and returns an error.
So, is this still exploitable? With postgresql and tomcat environment.