咨询：4个单引号是否仍可在SQL Server中引发注入？老旧项目注入求助

First, let’s confirm what you’ve already spotted—your example perfectly illustrates a classic string-termination SQL injection. When the user inputs ' SELECT 2-- , it breaks out of the original string literal in the SQL query:

SELECT '1 ' SELECT 2-- ';

The user-provided single quote closes the initial '1 string, letting the injected SELECT 2 execute, and the -- comments out the trailing quote and leftover syntax to avoid errors. That’s textbook injection when unvalidated user input gets directly glued into SQL statements without safeguards.

Now, to your core question: Will four single quotes ('''') escape and trigger SQL injection in MS SQL Server?

Short answer: No, not under standard string parsing rules. Here’s why:

• In MS SQL Server, single quotes inside a string literal are escaped by doubling them. For example, 'This isn''t a test' resolves to the plain text This isn't a test.
• If an attacker inputs four single quotes ('''') and there’s zero input sanitization, the resulting concatenated query would look like this (assuming your original query structure is SELECT '1[USER_INPUT]';):

  SELECT '1''''';
  

  SQL Server parses this as a single, valid string literal: the first quote opens the string, each pair of quotes ('') resolves to one literal quote, and the final quote closes the string. The end result is the string 1''—no escape from the string boundary, no injected SQL code runs.

That said, edge cases could pop up if the legacy code has broken string-handling logic (like partial escaping, input truncation, or weird encoding), but under the "no sanitization, direct concatenation" scenario you described, four single quotes won’t lead to an injection.

If you can recommend fixes (even without accessing the C++ code), pushing for strict input validation (restricting allowed characters to only what’s necessary) or switching to parameterized stored procedures (if the project can support it) would be the best long-term safeguards against these issues.

内容的提问来源于stack exchange，提问作者Samyne