Looks correct to me. What issue do you have with it?
They're saying injection attacks come from dynamically building strings, so if you prevent that you stop the vulnerabilities.
They're saying injection attacks come from dynamically building strings, so if you prevent that you stop the vulnerabilities.
The argument isn't "block ' characters to stop SQL injection" it's "force the developer to use prepared statements and no dynamically constructed queries".
Second, the naive and silly attacks are the default definition of SQL injection -- and the most commonly found holes, so even if it just prevented those that would be still a huge help. Nothing statically ensures that at runtime except the programmer's due diligence.