Dangerous backslash escaping for MS Access

Many developers still rely on escaping user's inputs by adding backslashes (like using magic_quotes_gpc or addslashes() in PHP), where it is well known that adding backslash to escape inputs in not sufficient to prevent SQL Injections attacks for many different reasons.

One of those reasons is that MS Access uses a different method to escape apostrophe (') which is doubling it ('') instead of prefixing it with a backslash (\').

It's true that injection takes place easily in this case, but leveraging it is not so easy using traditional injection technique. Since an excess slash will corrupt the query structure and causes error (actually "Syntax error (missing operator) in query expression...").

For example consider this query:

SELECT * FROM Users WHERE Username = '$user' AND Password = '$pass'

If the attacker enters the usual a' OR 'a'='a as username and password, the query would be like the following, which causes syntax error:

SELECT * FROM Users WHERE Username = 'a\' OR \'a\'=\'a' AND Password = 'a\' OR \'a\'=\'a'

The reason is the query has excess slashes (which are highlighted by red). But (un)fortunately backslash (\) in MS Access is integer divide operator, and this property can be used to make the query valid.

If the attacker enters a' OR 5=10'2 as username and password, after prefixing it with backslash, it would be a\' OR 5=10\'2 which make the query like the following which is valid this time:

SELECT * FROM Users WHERE Username = 'a\' OR 5=10\'2' AND Password = 'a\' OR 5=10\'2'