The company I work for has recently moved to an external vendor for payroll services. We did an initial upload of data from our old system to the new vendor. I noticed that our employees that have apostrophes in their names (O’Riley for example) were no longer matching up with other systems. The new payroll vendor had removed the apostrophes. We are able to manually add the apostrophe back in via the web based front end, and running a report immediately after the change shows the apostrophe, but the character is removed by the next day.
When I inquired with the payroll vendor about the removed characters, I was informed that "The system will automatically remove quotes as they are problematic in the database itself." It was recommended that we use the grave (backward single quote) character instead because it looks similar to a single quote.
My question is this: Does the inability to handle quotes (single or double) in a database indicative of vulnerability to sql injection and is there a safe and legal way to prove or disprove this vulnerability?
This is a payroll system and I am hesitant to attempt to discover any vulnerability on the live system and I do not have access to a test system.