What kind of SQL injection would a SQL statement be vulnerable to if it only escapes single quotes instead of actually using SQL parameters?
107307
Can I protect against SQL injection by escaping single-quote and surrounding user input with single-quotes?
139754
How do I escape a single quote in SQL Server?
95323
Is there an equivalent of PHP's mysql_real_escape_string() for Perl's DBI?
46503
Do htmlspecialchars and mysql_real_escape_string keep my PHP code safe from injection?
16324
How does a PreparedStatement avoid or prevent SQL injection?
10938
Escaping quotation marks in PHP
38732
How does the SQL injection from the "Bobby Tables" XKCD comic work?
124286
Java - escape string to prevent SQL injection
63852
Oracle SQL Syntax: Quoted identifier
23405
What does the "@" symbol do in SQL?
75027
Why is using a mysql prepared statement more secure than using the common escape functions?
23348
Passing parameters to a JDBC PreparedStatement
8989
When to use single quotes, double quotes, and backticks in MySQL
37310
In Java, is there a way to write a string literal without having to escape quotes?
148619
Is there a reason not to use  (null safe equals operator) in mysql instead of =?
38106
PostgreSQL - query syntax without quotes
89999
java.sql.SQLException Parameter index out of range (1 > number of parameters, which is 0)