SQL Injection in MS Access with backslash escaped input

[gheibi@xxxxxxxxx]

Many developers still rely on escaping user's inputs by adding backslashes 
(like using magic_quotes_gpc or addslashes() in PHP), where it is well known 
that adding backslash to escape inputs in not sufficient to prevent SQL 
Injections attacks for many different reasons.

One of those reasons is that MS Access uses a different method to escape 
apostrophe (') which is doubling it ('') instead of prefixing it with a 
backslash (\').

It's true that injection takes place easily in this case, but leveraging it is 
not so easy using traditional injection technique. Since an excess slash will 
corrupt the query structure and causes error (actually "Syntax error (missing 
operator) in query expression...").

For example consider this query:

    SELECT * FROM Users WHERE Username = '$user' AND Password = '$pass'

If the attacker enters the usual "a' OR 'a'='a" as username and password, the 
query would be like the following, which causes syntax error:

    SELECT * FROM Users WHERE Username = 'a\' OR \'a\'=\'a' AND Password = 'a\' 
OR \'a\'=\'a'

The reason is the query has excess slashes. But (un)fortunately backslash (\) 
in MS Access is integer divide operator, and this property can be used to make 
the query valid.

If the attacker enters "a' OR 5=10'2" as username and password, after prefixing 
it with backslash, it would be "a\' OR 5=10\'2" which make the query like the 
following which is valid this time:

    SELECT * FROM Users WHERE Username = 'a\' OR 5=10\'2' AND Password = 'a\' 
OR 5=10\'2'