Bypass & amp; #39; (single quotes) in SQL injection to continue Injection

I think many of you have read some articles about SQL Injection attacks against SQL Server, because of insufficient or even insufficient variable filtering to construct malformed SQL statement Injection, this is also an example of the "Implementation and Application of SQL Injection" I wrote. Because no filtering is encountered, it makes it quite easy for us to inject data successfully, as shown below:
Asp? Id = 1; exec "> http://www.ilikeplmm.com/show.asp? Id = 1; exec master. dbo. xp_cmdshell net user angel pass/add ;--

This often leads to misunderstandings. It is believed that as long as the variables are filtered, SQL Injection attacks can be prevented. This awareness is the root cause for a large number of programs to be injected. In fact, filtering alone is not enough, when the filter is used, let's take a look at the following statement:

Http://www.ilikeplmm.com/show.asp? Id = 1; declare % 20 @ a % 20 sysname % 20 select % 20 @ a = running % 20 exec % 20master. dbo. xp_mongoshell % 20 @ ;--

Is there a big difference with the above sentence? However, the results are exactly the same. These are all SQL statements.

Bytes

This is the hexadecimal format of "net user angel pass/add. If you know SQL, you can easily understand it. Declare a variable a first, assign the value of our command to a, and then call variable a to execute the input command. Variable a can be any command. As follows:

Declare @ a sysname
Select @ a =
Exec master. dbo. xp_mongoshell @

Solution:

Filter variables. Only specific characters are allowed. For example, for numeric variables, only numeric data can be entered. Not to mention it. This is completely the freedom of the program author.