title: SQL injection without single quotes
body: <p>Is there a way to do a SQL injection without using the single quote <code>'</code>?</p>
  
  <p>I've looked to a lot of questions but they are all about single quote escaping or they do not contain a solution (<a href="https://stackoverflow.com/questions/5520840/sql-injection-after-removing-all-single-quotes-and-dash-characters">SQL Injection after removing all single-quotes and dash-characters</a>).</p>
  
  <p>I'm doing a hack game and basically I have to extract a password from a db, I'm trying to do it by exploiting this query:</p>
  
  <pre><code>query = text("INSERT INTO data_table VALUES ([other values], '%s')" % data)
  db.engine.execute(query, user=username)
  </code></pre>
  
  <p>trying to set data to:</p>
  
  <pre><code>'SELECT password FROM users WHERE username="admin" '
  </code></pre>
  
  <p>I think that this way the select should be executed and its result stored as data (I can easily read back that data from the website).</p>
  
  <p>The problem is that when uploading the value that goes into data I cannot use the single quote <code>'</code> (the system shows an error and I have to choose another value).</p>
  
  <p>Is there a way to perform a similar injection without the single quote?</p>