SQL Injection Attacks by Example - Unixwiz.net
Be aware that "sanitizing the input" doesn't mean merely "remove the quotes", because even "regular" characters can be troublesome. In an example where an integer ID value is being compared against the user input (say, a numeric PIN): SELECT fieldlist FRO...