How can you place a string into your query without using any quotation marks?

You have found a SQL injection vulnerability in a numeric field, but you need to use a string value in one of your attack payloads.How can you place a 开发者_如何转开发string into your query without using any quotation marks?

---

Use a parametrized query instead of concatenation strings. Guide to SQL Injection

---

Escape ' with ''

INSERT INTO Foo(A)VALUES('GEORGE''S CAT')