title: Replacing single quotes with double quotes in SQL Query
body: <p>I am creating a vulnerable Windows Forms application using C# to practise SQL Injection and understand why this vulnerability happens in the first place. I am aware that I should be using parameterised queries to develop a secure application.</p>
  
  <p>The application requires a user to enter their username and password in order to login. The following code is responsible for dynamically generating an SQL query based on user’s input:</p>
  
  <pre><code>public SqlDataReader performLogin(String username_input, String password_input)
  {
      String username = username_input;
      String password = password_input;
  
      String sqlquery = "SELECT * FROM users where username='" + username + "' and password='" + password + "'";
  
      SqlCommand query = new SqlCommand(sqlquery, conn);
  
      SqlDataReader reader = query.ExecuteReader();
  
      return reader;
  }
  </code></pre>
  
  <p>The SQL Server database contains a username called ‘admin’, and I can login as that user without knowing their password by entering the following data in the username field:</p>
  
  <pre><code>admin'--
  </code></pre>
  
  <p>However, I would like to modify the dynamically generated SQL query so that I would have to enter double quotes (not two single quotes) instead of one single quote in order to login as admin:</p>
  
  <pre><code>admin"--
  </code></pre>
  
  <p>I’ve tried replacing every double quote character with a single quote and every single quote with double quotes. I’ve also tried replacing every single quote character with double quotes and escaping them as follows:</p>
  
  <pre><code>String sqlquery = "SELECT * FROM users where username=\"" + username + "\" and password=\"" + password + "\"";
  
  String sqlquery = "SELECT * FROM users where username=@"" + username + "@" and password=@"" + password + "@"";
  </code></pre>
  
  <p>I've not been able to find a working solution yet. I either get syntax errors or the application crashes after I attempt to login.</p>