What kind of SQL injection would a SQL statement be vulnerable to if it only escapes single quotes instead of actually using SQL parameters?
Can I protect against SQL injection by escaping single-quote and surrounding user input with single-quotes?