There is much to exploit if the driver itself is buggy.<p>Theoretically it&#x27;s possible that between various 8bit&#x2F;16bit encodings, locales, collations, client&#x2F;server configuration mismatches somebody could find a creative way to smuggle some unescaped quotemark.<p>Binary protocol which parses SQL commands client-side and treats strings as blobs of bytes removes any chance of SQL injection for good.