SQL Injection in MS Access with backslash escaped input

[gheibi () gmail com]

Many developers still rely on escaping user's inputs by adding backslashes (like using magic_quotes_gpc or addslashes() 
in PHP), where it is well known that adding backslash to escape inputs in not sufficient to prevent SQL Injections 
attacks for many different reasons.

One of those reasons is that MS Access uses a different method to escape apostrophe (') which is doubling it ('') 
instead of prefixing it with a backslash (\').

It's true that injection takes place easily in this case, but leveraging it is not so easy using traditional injection 
technique. Since an excess slash will corrupt the query structure and causes error (actually "Syntax error (missing 
operator) in query expression...").

For example consider this query:

    SELECT * FROM Users WHERE Username = '$user' AND Password = '$pass'

If the attacker enters the usual "a' OR 'a'='a" as username and password, the query would be like the following, which 
causes syntax error:

    SELECT * FROM Users WHERE Username = 'a\' OR \'a\'=\'a' AND Password = 'a\' OR \'a\'=\'a'

The reason is the query has excess slashes. But (un)fortunately backslash (\) in MS Access is integer divide operator, 
and this property can be used to make the query valid.

If the attacker enters "a' OR 5=10'2" as username and password, after prefixing it with backslash, it would be "a\' OR 
5=10\'2" which make the query like the following which is valid this time:

    SELECT * FROM Users WHERE Username = 'a\' OR 5=10\'2' AND Password = 'a\' OR 5=10\'2'