The site said the injection is Hex encoded. Therefore, sanitising the input won't work because the injection isn't using any single quotes at all. To be honest,

The site said the injection is Hex encoded. Therefore, sanitising the input won't work because the injection isn't using any single quotes at all. To be honest, I have no idea how to sanitise Hex encoded input, in either MS SQL or MySql od Postgres. The important part seems to be the fact that MS SQL allows "query stacking by separating the queries." Does this mean you can input multiple queries without using a semicolon (which you'd normally escape if you're not using a prepare statement) in MS SQL, and thus this is how the injection worms its way into your DBMS? Besides, what does he mean by"by separating the queries"? A space? Surely not. I don't fully understand it. Anyone?