I respectfully disagree with your claim that replacing ' with '' will complete the security. Reason: there are non-string cases, so there exists concatenations

I respectfully disagree with your claim that replacing ' with '' will complete the security. Reason: there are non-string cases, so there exists concatenations like: "WHERE SomeNumber = " + inputValue + " ... " but inputValue is a string (from untyped xml), but is put into SQL without quotes because SomeNumber is an int type in the database. Since the xml is constructed without validation, an attacker could put any value there, including strings to inject, and do so without using quotes.