An attacker can&#x27;t necessarily leverage ASC&#x2F;DESC injection unless multiple queries can be issued by a single SQL statement (i.e. injecting &quot;ASC; SELECT * FROM...&quot;) which isn&#x27;t commonly enabled in most database deployments.  But there are probably other insecurities here.<p>The solution is to run every input through a function that replaces each single quote with two single quotes.  That is all that&#x27;s required to prevent SQL injection, since it&#x27;s not possible to construct a valid query regardless of the injection point.  (EDIT:  This refers to string inputs.  Numeric inputs are handled in the obvious way, as is ASC&#x2F;DESC.  Injection into an ORDER BY clause is not usually exploitable.  These are all of the cases.)<p>If you propose this solution to management, they may be somewhat more likely to take action, since it can be applied to the existing system.