Let's assume we're building a aql query like this:
SELECT * FROM users WHERE username = 'Username' AND password='password'
If we blocked the characters (") and ('), will an attacker be able to hack into it at all?

Here's my regex statement /[\"\']/ and if there are any matches it will block the request. I'm also trying to avoid using mysqli prepare.