Well, if that really is the code, this isn't the case, but there are functions in PHP to help prevent these kind of attacks, IIRC, mysql_real_escape_string(). You might could try altering it a bit instead of using ' use maybe %27 or double unicode enocde? Probably won't work, but regardless, the point of SQL Injection is to add/modify the SQL query, so start thinking about what query you have out there and how you could alter it and you will find that it isn't always necessary to have ' to do a SQL Injection...