title: Double Quote Injection
body: <p>Is it enough to replace all single quotes in a T-SQL statement with double quotes to prevent injections? </p>
  
  <p>I have this PHP function to escape user input which is then executed directly.</p>
  
  <pre class="lang-php prettyprint-override"><code>&lt;?php
  
      function clean($input) {
          return str_replace('\'', '\'\'', $input);
      }
  
      echo 'INSERT INTO Temp ([test]) VALUES (\'' .clean($_GET['test']). '\')';
  </code></pre>
  
  <p>Example: <code>$_GET['test']</code> is <code>'test</code>, it would be escaped to <code>'''test'</code>.</p>
  
  <p>I know, I should use prepared statements, but I want to know if this is vulnerable.</p>